PHILADELPHIA, PA – Wawa will be paying the state of Pennsylvania $8 million to settle a data breach lawsuit, but it’s not sure how many, if any customers affected by the breach will be compensated by the settlement.
Pennyslvvania Attorney General Josh Shapiro announced an $8 million agreement with Wawa to resolve a December 2019 data breach that compromised approximately 34 million payment cards used across all Wawa stores.
Pennsylvania will collect $2,525,732 through this settlement.
“AG Shapiro immediately opened an investigation after Wawa proactively notified his Office that the company experienced a data security incident. The investigation concluded that Wawa failed to employ reasonable security measures, which allowed hackers to gain access to Wawa’s network and deployed malware on the company’s payment processing servers at its stores,” the state said in a statement regarding the breach. “The malware allowed the hackers to obtain the payment card information of Wawa customers between April 18, 2019 and December 12, 2019. In Pennsylvania, approximately 9.1 million payment cards were potentially exposed to the hacker.”
“Today’s settlement will help protect Pennsylvanians personal information going forward and will hold Wawa accountable for the data breach that occurred on their watch,” AG General Shapiro said. “Thanks to this work Wawa will adopt new corporate policies to deter data breaches in the future. Every corporation that does business in Pennsylvania needs to stay alert and protect their customer’s personal data or they will have to answer to my office.”
In addition to the $8 million total payment to the states, Wawa has agreed to implement and maintain a series of data security practices designed to strengthen its information security program and safeguard the personal information of consumers.