Three weeks ago, Wawa unveiled a special Christmas present to its customers. The company’s payment processing servers had been infected with malware, which swiped credit and debit card numbers, expiration dates, and cardholder names. Not only did this affect every store throughout the chain – whether at the pump or at a register – the malware was active for about nine months, from March 4th, 2019 to December 10, 2019.
In other words, if you bought anything at Wawa with a card throughout that time, you’re affected.
The CEO of Wawa, Chris Gheysens, published an open letter to consumers on December 19, 2019, where he explained the company was investigating and addressing a “data security incident.” He stated the company’s IT security team discovered malware on the Wawa payment processing servers on December 10, 2019, and “contained” it by December 12, 2019.
Gheysens added, “This malware affected customer payment card information used at potentially all Wawa locations beginning at different points in time after March 4, 2019 and until it was contained. At this time, we believe this malware no longer poses a risk to Wawa customers using payment cards at Wawa, and this malware never posed a risk to our ATM cash machines.”
Don’t Panic, The Malware Didn’t get Everything
According to Gheysens, the malware compromised payment card data, but no other personal information was accessed, such as debit card PIN numbers, credit card CVV2 numbers (the three or four-digit security code printed on the card), other PIN numbers (gift cards and the like), and driver’s license information used to verify age-restricted purchases.
Although customer data was being mined for months, there’s no evidence of it being used anywhere yet. This means you’ve got a chance to get ahead of this thing.
Wawa’s Offering Free Credit Monitoring and Identity Theft Protection
Wawa has arranged a dedicated toll-free call center to answer customer questions and offer credit monitoring and identity theft protection without charge to anyone whose information may have been involved. The number to use this service is 1-844-386-9559. You can enroll at the Experian IdentityWorks website, and Gheysens included this activation code in his letter: 4H2H3T9H6.
Gheysens Also Offered This Advice
Review Your Payment Card Account Statements
“We encourage you to remain vigilant by reviewing your payment card account statements. If you believe there is an unauthorized charge on your payment card, please notify the relevant payment card company by calling the number on the back of the card. Under federal law and card company rules, customers who notify their payment card company in a timely manner upon discovering fraudulent charges will not be responsible for those charges.”
Order a Credit Report
“If you enroll in the Experian service (at the phone number above) we are offering, you will have access to activity on your credit report. In addition, if you are a U.S. resident, you are entitled under U.S. law to one free credit report annually from each of the three nationwide consumer reporting agencies. To order your free credit report, visit www.annualcreditreport.com or call toll-free at 1-877-322-8228.”