Wawa convenience stores is reporting a massive data breach that impacted payment card transactions potentially at all of its 800 locations.
Malicious actors managed to place malware on Wawa’s in-store and fuel pump POS systems starting on March 4, 2019 with all of its stores most likely being compromised by April 22. The company discovered the issue on December 10 and was able to fully block and remove the malware by December 12.
The information potentially stolen includes credit and debit card numbers, expiration dates and cardholder names. Debit card PINs and credit card CW2 numbers were not affected. Wawa gift cards also may be involved, although not specifically targeted, with the card numbers being stolen. The company is asking anyone who believes their gift card is affected to get in contact with Wawa customer service at 1-800-444-9292.
However, ATMs
located at Wawa locations were not part of the breach.
Wawa President
and CEO Chris Gheysens said
the company will cover any fraudulent purchases made with payment card data stolen
during this incident.
The company
did not say how many potential victims were involved nor was any information
given on how the malware was put in place.
Jason Kent, hacker in residence at Cequence Security, noted an interesting point in the company’s disclosure.
“The unusual
part of this story is that they weren’t notified of the breach externally. Does
this mean the malware didn’t work? Did the perpetrator not sell the numbers for
some reason? Is all of the effort to mitigate these types of attacks starting
to work,” he said.
Other
industry pros expressed some satisfaction that Wawa security apparatus was able
to at least partially protect their customers.
“It’s still
unknown how the criminals breached the network and accessed the data and it
appears that the criminals were only able to get part of the credit card
information. This is a testament to the
organization’s separation of data within their infrastructure to isolate the
information, so if one system is compromised then all of the data cannot be
stolen,” said James McQuiggan, KnowBe4’s security awareness advocate.
On the flip side Emily Wilson, vice president of research at Terbium Labs, was unimpressed with the amount of time the malware remained active and undetected.
“In this
case, cyber criminals had the better part of the year to siphon off cardholder
information from Wawa’s vast network of stores; while I’m sure the fraudsters
weren’t happy to be caught, they can boast quite a trove of information from
their time undetected,” she said.
Although it
has not been revealed what type of malware was involved, retailers across the
country have been hit repeatedly in 2019 with Magecart attacks predominating.
In August Pedro Fortuna, CTO of Jscramber, penned the SC Media Executive
Insight column Five
strategies to stop Magecart to help companies from being victimized.
