Wawa Settles With 7 States Over Data Breach

The outside of a Wawa store at night.
Image via iStock.

Wawa will pay $8 million in a settlement agreement of a lawsuit filed by seven states, including Pennsylvania, over hacked customer payment cards, writes Brian X. McCrone for NBC 10.

Hackers used malware to access Wawa’s payment processing servers between April and December 2019, potentially exposing information from 9.1 million payment cards.

Attorneys general from the seven states sued Wawa over the breach.  Pennsylvania will receive $2.5 million in the settlement. New Jersey and five other states will also receive payments.

The money will pay, in part, for attorney’s and court fees. It’s not known if customers will receive money from the settlement.

Wawa also agreed to have a security program in place to protect sensitive personal information collected from customers.

“Thanks to this work Wawa will adopt new corporate policies to deter data breaches in the future. Every corporation that does business in Pennsylvania needs to stay alert and protect their customer’s personal data or they will have to answer to my office,” said Pennsylvania Attorney General Josh Shapiro.

A class action lawsuit was filed by customers in late December 2019. In that settlement, Wawa agreed to pay customers up to $9 million in gift cards and cash.

Read more at NBC 10 about this latest data breach settlement.