The fallout from the Wawa data breach continues to expand. Reports indicate customer data from the breach is now for sale on the dark web and the total number of compromised payment card accounts may reach 30 million. With more than half of Wawa’s stores located in Pennsylvania and New Jersey, the Wawa breach is one of the most important cybersecurity events in local history.

The iconic Delaware Valley convenience store announced the data security breach in December 2019. Wawa admits all 850 Wawa locations may have fell victim to malware running on in-store payment systems between April and December 2019. The malware targeted credit card information from fuel dispensers and in-store payment terminals. Information compromised in the breach includes debit and credit card numbers, expiration dates and cardholder names. Wawa maintains the breach did not reveal personal identification numbers (PINs) or CVV records (the three-digit security code on the back of a payment card).