$8 Million Multistate Settlement Resolves 2019 Data Breach Investigation

State Attorneys General settle with Wawa, Inc. for 2019 data breach that compromised approximately 34 million payment cards used by consumers.

On July 26, 2022, Acting New Jersey Attorney General Matthew J. Platkin announced that New Jersey is co-leading an $8 million multistate settlement with Wawa, Inc. (Wawa) that resolves a data breach that occurred from April 18, 2019 to December 12, 2019 and affected stores in New Jersey, Pennsylvania, Florida, Delaware, Maryland, Virginia and Washington DC. The data breach was the result of malware that was used by hackers to harvest Wawa customers' card numbers, expiration dates, cardholder names and other sensitive payment card data (though cards using chip technology were not compromised). Notably, security card CVV2 codes and personal identification numbers were not collected. According to documents related to a private class action, the breakdown of consumer pay card transactions during the relevant period was