ORLANDO, Fla. — Wawa announced Thursday that customers debit and credit card information may have been compromised during a security incident.
The company said the information is limited to customers card information, including debit and credit card numbers, expiration dates and cardholder names, but does not include pin numbers or CVV2 numbers.
Wawa said its information security team discovered malware on Wawa’s payment processing servers on Dec. 10 and contained it by Dec. 12.
Read: Yahoo! data breach settlement: How to get $358 or free credit monitoring
After discovering the malware, Wawa said it notified law enforcement and an external forensics firm.
Wawa said the malware began running at different points in time after March 4, 2019. It believes the malware no longer poses a risk to customers.
Wawa released a statement regarding the incident:
“At Wawa, the people who come through our doors are not just customers, they are our friends and neighbors, and nothing is more important than honoring and protecting their trust,” said Chris Gheysens, Wawa CEO. “Once we discovered this malware, we immediately took steps to contain it and launched a forensics investigation so that we could share meaningful information with our customers. I want to reassure anyone impacted they will not be responsible for fraudulent charges related to this incident. To all our friends and neighbors, I apologize deeply for this incident.”
Wawa said it is supporting its customers by offering identity protection and credit monitoring services at no charge to them.
Information about how to enroll can be found here.
Read: Data breach could affect customers at 6 Central Florida restaurants
Wawa said anyone with questions is asked to call 844-386-9559, Monday through Friday between 9 a.m. and 9 p.m. or Saturday and Sunday between 11 a.m. and 8 p.m., excluding holidays.
The ATM cash machines in Wawa stores were not impacted by this incident.
The company said it is not aware of any unauthorized use of any payment card information as a result of the incident.