Delaware joins six other states in an $8 million settlement with Wawa triggered by a 2019 data breach.
That breach compromised more than 34 million credit cards used at Wawa stores, including those in Delaware.
The breach began when hackers gained access to Wawa’s central computer system through a phishing attack; they then targeted sales terminals at individual stores over nine months. During that time, customers used more than 1.2 million credit cards at Delaware locations.
Though hackers obtained customers’ credit card numbers, names and expiration dates, they did not access PIN numbers or security codes. Customers using chip cards were not affected.
Attorney General Kathy Jennings argues Wawa was partially responsible because it had not implemented proper information security practices. Wawa has not admitted wrongdoing, but the settlement requires the company to develop and train employees to use a new information security program.
Delaware will receive $450,000 from the settlement.
Wawa previously settled a class action lawsuit by customers impacted by the data breach for $12 million.
