Mid-Atlantic Convenience Chains · Convenience Store (regional) · Structural / no discrete incident
Wawa
Headline
Wawa is one of the most regionally significant breaches in this tracker: malware sat on point-of-sale systems at potentially every Wawa location for roughly nine months in 2019 before discovery, collecting payment card…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Wawa is one of the most regionally significant breaches in this tracker: malware sat on point-of-sale systems at potentially every Wawa location for roughly nine months in 2019 before discovery, collecting payment card data from in-store and fuel purchases. The stolen cards were subsequently offered on a criminal marketplace in one of the largest card dumps ever posted. For the DMV, Wawa is a near-daily stop for an enormous number of households, and the exposure ran through the most routine transaction there is - buying gas or a sandwich with a card.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
ONE OF THE MOST DIRECTLY REGIONALLY-SIGNIFICANT BREACHES IN THIS ENTIRE TRACKER: between March 4, 2019 and December 12, 2019, cybercriminals accessed Wawa's payment systems and obtained CARDHOLDER INFORMATION (card numbers, expiration dates, cardholder names) for approximately 30 MILLION PAYMENT CARDS used at Wawa stores or fuel pumps across its footprint (concentrated in PA, NJ, DE, MD, VA — directly the Mid-Atlantic region this tracker covers). The resulting litigation was consolidated into 15 actions across THREE separate tracks: financial institutions, employees, and consumers. Wawa's settlements include: a consumer settlement making up to $9 million in gift cards and cash available (final approval in an April 20, 2022 opinion, E.D. Pa.), whose separate $3.2 million fee award was vacated by the Third Circuit after an objection and reinstated on remand in April 2024 (the Third Circuit then affirmed that award on June 25, 2025, In re Wawa, Inc. Data Sec. Litig., No. 24-1874); an $8 million multistate attorney-general settlement (2022); and a financial-institution settlement of up to $28.5 million reached in March 2023 (plus up to $9 million more for notice, administration and fees). Later approval and distribution dates were not verified this pass.
Fees and billing
A notable OBJECTION was filed against the settlement (by the Hamilton Lincoln Law Institute's Center for Class Action Fairness) arguing the deal would pay ATTORNEYS MORE than the class members they represented — a recurring critique in class-action settlement practice generally, worth noting as a genuine point of contention in how this specific settlement was ultimately structured.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy wawa.com/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service wawa.com/terms-of-use | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.