Wawa: Thieves May Have Tried To Sell Stolen Customer Data

WAWA, PA — After Wawa and its customers were the victims of a massive data breach, the convenience chain said it recently learned those who stole data have tried to sell it.

Wawa Tuesday said the company learned of reports of attempts to sell some customer payment card information potentially involved in the previous data breach in December last year that affected all of its 850 stores in Pennsylvania, New Jersey, Delaware, Maryland, Virginia, Florida and Washington, D.C.

"We have alerted our payment card processor, payment card brands, and card issuers to heighten fraud monitoring activities to help further protect any customer information," Wawa said in a statement. "We continue to work closely with federal law enforcement in connection with their ongoing investigation to determine the scope of the disclosure of Wawa-specific customer payment card data."

Wawa says its customers should keep vigilant in checking their credit, debit, and other payment card statements for any suspicious activity.

Under federal law and card company rules, customers who notify their card issuer in a timely manner of fraudulent charges will not be responsible for those charges, Wawa said.

Additionally, Wawa said it will work with customers whose card companies do not reimburse them to reimburse them for fraudulent charges.

"Wawa remains focused on providing resources and support to our customers who may be impacted by this incident," Wawa said." We remind customers to sign up for the credit monitoring and identity theft protection we are offering free of charge by visiting our website or by contacting our dedicated toll-free call center, 1-844-386-9559."

Wawa says it is confident the malware discovered on its payment processing servers Dec. 10 has not posed a risk to customers since it was contained Dec. 12.

Additionally, Wawa says only payment card information was involved. No debit card PIN numbers, credit card CVV2 numbers, or other personal information was included in the breach.

Customers were notified of the breach on Dec. 19 when Wawa CEO Chris Gheysens posted a letter on the store's websiteoutlining the situation and provided ways customers can protect themselves.

The breach prompted the FBI to become involved in the case.

Anyone who is concerned that their debit or credit cards were compromised or who has questions about the breach can call a dedicated toll-free call center: 844-386-9559. Wawa is offering free credit monitoring and identity theft protection to anyone whose information may have been involved.

If you detect any incident of identity theft or fraud, promptly report the incident to your local law enforcement authorities, your state attorney general and the Federal Trade Commission. If you believe your identity has been stolen, the FTC recommends that you take these additional steps:

• Close the accounts that you have confirmed or believe have been tampered with or opened fraudulently. Use the FTC's ID Theft Affidavit (available at www.ftc.gov/idtheft) when you dispute new unauthorized accounts.
• File a local police report. Obtain a copy of the police report and submit it to your creditors and any others requiring proof of the identity theft crime.

Customers whose information may have been involved should:

• Review your debit and credit card account statements. Unauthorized charges should be reported immediately. Under federal law and card company rules, customers who notify their payment card company in a timely manner upon discovering fraudulent charges will not be responsible for those charges.
• Register for identity protection services. "We have arranged with Experian to provide potentially impacted customers with one year of identity theft protection and credit monitoring at no charge to you," Gheysens said. Information about these services is available on the Wawa website or by calling the dedicated data breach number: 844-386-9559.
• Order a credit report. "If you enroll in the Experian service (at the phone number above) we are offering, you will have access to activity on your credit report. In addition, if you are a U.S. resident, you are entitled under U.S. law to one free credit report annually from each of the three nationwide consumer reporting agencies," the letter said. To order your free credit report, visit www.annualcreditreport.com or call toll-free at 877-322-8228.

Wawa customers with questions about the data breach or enrolling in the credit monitoring services can call the data breach response line at 844-386-9559. It is open 9 a.m. to 9 p.m. Eastern Time Monday through Friday and 11 a.m. to 8 p.m. on Saturday and Sunday, excluding holidays (which include Dec. 24, Dec. 25, Dec. 31, Jan. 1, and Jan. 20).

Other steps the company recommends:

Order your free credit report: Visit www.annualcreditreport.com, call toll-free at 877-322-8228, or complete the Annual Credit Report Request Form on the U.S. Federal Trade Commission's website at www.ftc.gov and mail it to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281. Do not contact the three credit bureaus individually; they provide your free report only through the website or toll-free number.

When you receive your credit report, review the entire report carefully. Look for any inaccuracies and/or accounts you don't recognize, and notify the credit bureaus as soon as possible in the event there are any.

You have rights under the federal Fair Credit Reporting Act. These include, among others, the right to know what is in your file; to dispute incomplete or inaccurate information; and to have consumer reporting agencies correct or delete inaccurate, incomplete or unverifiable information. More information about the FCRA is on the Federal Trade Commission website.

Place a fraud alert on your credit file: To protect yourself from possible identity theft, consider placing a fraud alert on your credit file. A fraud alert helps protect you against the possibility of an identity thief opening new credit accounts in your name. When a merchant checks the credit history of someone applying for credit, the merchant gets a notice that the applicant may be a victim of identity theft. The alert notifies the merchant to take steps to verify the identity of the applicant.

You can report potential identity theft to all three of the major credit bureaus by calling any one of the toll-free fraud numbers below. You will reach an automated telephone system that allows you to flag your file with a fraud alert at all three bureaus:

• Equifax: 800-525-6285, www.equifax.com
• Experian: 888-397-3742, www.experian.com
• TransUnion: 800-680-7289, www.transunion.com

Place a security freeze on Your credit file: You have the right to place a "security freeze" on your credit file. A security freeze generally will prevent creditors from accessing your credit file at the three nationwide credit bureaus without your consent. You can request a security freeze free of charge by contacting the credit bureaus

Placing a security freeze on your credit file may delay, interfere with or prevent timely approval of any requests you make for credit, loans, employment, housing or other services. For more information regarding credit freezes, contact the credit reporting agencies directly.