Wawa Data Breach In Maryland 2019: Dates, Stores, Resources

MARYLAND — A data breach at Wawa may have exposed payment information from customers who used credit cards or debit cards at its stores nationwide, including those in Maryland.

Wawa found malware on its payment processing systems Dec. 10, according to a statement the company issued Thursday. Malware is unwanted software that can monitor online activity and be used to steal personal information and commit fraud.

"At this time, we believe this malware no longer poses a risk to Wawa customers using payment cards at Wawa, and this malware never posed a risk to our ATM cash machines," Wawa CEO Chris Gheysens said in the Dec. 19 open letter about the data security breach.

The malware was installed after March 4 and has been contained as of Dec. 12, officials said.

"Once we discovered this malware, we immediately took steps to contain it," Gheysens said.

Wawa alerted law enforcement and began working with a leading forensics firm on the probe.

Based on the investigation, Wawa determined customer information may have been exposed from March 4 to Dec. 12 from payment cards used at cashier terminals and fuel pumps. The malware had been installed on most store systems by April 22, officials said.

Wawa has stores in Maryland, Pennsylvania, New Jersey, Delaware, Virginia, Florida and Washington, D.C. All locations may have been impacted, Wawa reported.

The following information may have been compromised, according to Wawa:

• Credit card numbers
• Debit card numbers
• Expiration dates
• Cardholder names

These were not affected by the data breach, according to Wawa:

• PINs
• Three-digit security codes on the backs of cards
• Driver's licenses
• ATMs in stores

As of Dec. 19, Wawa said it had not received any reports of unauthorized use of payment card information as a result of the malware.

What Wawa Customers Should Do

The company has committed to providing identity theft protection and credit monitoring for one year through Experian to those who may be affected by the Wawa data breach.

"I want to reassure anyone impacted they will not be responsible for fraudulent charges related to this incident," Gheysens said. "At Wawa, the people who come through our doors are not just customers — they are our friends and neighbors, and nothing is more important than honoring and protecting their trust."

Here is guidance from Wawa about what to do next:

• Review account statements from payment cards you used at Wawa. Do you see an unauthorized charge? Call the number on the back to notify the payment card company.
• Get identity protection services — Wawa is offering one year of free monitoring. Wawa reports it has arranged with Experian to provide potentially impacted customers with one year of free identity theft protection and credit monitoring. Call toll-free to 1-844-386-9559.
• Order a credit report. Those who enroll in the Experian service by calling the number above will have access to activity on their credit reports. U.S. residents are entitled to one free credit report annually from each of the three nationwide consumer reporting agencies. Go to www.annualcreditreport.com or call 1-877-322-8228 to order a free credit report.

Residents in Maryland can get identity theft support from the Maryland Office of the Attorney General and may want to consider a credit freeze.

People can also contact the Federal Trade Commission to get help recovering from identity theft.

There are dozens of Wawa stores in Maryland, where the company has presence in Aberdeen, Abingdon, Annapolis, Baltimore, Bel Air, Beltsville, Cockeysville, Dundalk, Edgewater, Eldersburg, Elkton, Essex, Fallston, Gambrills, Glen Burnie, Grasonville, Halethorpe, Hanover, Joppa, Mechanicsville, Millersville, Prince Frederick, Reisterstown, Rosedale, Towson and Westminster.