Maryland Attorney General Brian E. Frosh this week announced that Maryland, along with six other attorneys general, has obtained an $8 million settlement with Wawa to resolve a December 2019 data breach that compromised approximately 34 million payment cards used at Wawa stores. Wawa has also agreed to a series of data security practices designed to strengthen its information security program and safeguard the personal information of consumers.
The Wawa data breach occurred after hackers gained access to Wawa’s computer network in late 2018 through a phishing attack, and later deployed malware on Wawa’s point-of-sale terminals. The malware extracted Wawa customers’ sensitive payment card information between April 18, 2019, and December 12, 2019, and affected stores in each of the six states where Wawa operates – New Jersey, Pennsylvania, Florida, Delaware, Maryland, and Virginia – as well as Washington, D.C.