Wawa Data Breach Aftermath: Observations From The Legal Side Of Things

The Wawa breach comes in the midst of ever-expanding legal obligations in the cybersecurity field

Back in December 2019, Wawa, Inc. announced that it had "experienced a data security incident" involving malware that had been running on its payment processing systems since as early as March 2019, which "affected payment card information," including credit and debit card numbers and other information." By January 2020, Wawa stated that it had learned of "reports of criminal attempts to sell some customer payment card information potentially involved" in the original data security incident it had reported in December. It expressed its confidence that the malware was contained in mid-December and that only payment card information was involved.