Wawa Breach Leaks Every Customer Credit Card Number.
Many retail data breaches leak partial customer data, partial credit card numbers or other bits of information that malicious actors can scrape and use as part of broader attacks. But the Wawa data breach is different. Every single customer that used their physical credit or debit card at a Wawa store since the spring of 2019 has had their card number stolen by malware on Wawa's point-of-sale servers, and the info is already for sale on the darkweb!
GoVanguard Recommendations to Protect Yourself:
1. For those affected, we highly recommend replacing your credit or debit card. If you choose not to do so, we recommend watching your payment transaction statements closely.
2. Wawa is required to provide free Identity Protection Services to those who are affected. If you do not already have ID Theft and Credit Monitoring (like LifeLock), navigate to https://www.experianidworks.com/credit and sign up with the activation code 4H2H3T9H6.
3. We recommend consumers switch to making in-store purchases with a digital wallet or mobile payment app like Apple Pay, Google Pay or Samsung Pay. With these apps, the merchant does not receive the details of your credit, debit card or checking account. They only receive a unique, one-time code for that specific purchase. Even if the merchant’s point-of-sale system is hacked, you will not have to worry about your card number being stolen.
4. For online retail purchases we recommend using Privacy.com (it’s free! They make money from interchange fees paid by merchants) that can generate merchant-specific card numbers and “burner” card numbers for online purchases so that you never have to use your real card number!
Next week, we will go over the details of the specific malware attack and how a systematic approach to monitoring and penetration testing would likely have mitigated the attack entirely. We will also discuss why a rigorous security protocol is crucial in all retail point-of-sale environments.
See you next week!
