Wawa to pay state attorneys general $8 million to settle malware data leak | National news

Popular convenience store and gas station chain Wawa is paying $8 million to six state attorneys general, including Florida, Maryland and the District of Columbia, to settle a 2019 data breach.

According to Florida Attorney General Ashley Moody, the December 2019 breach involved malware that allowed hackers to gain access to Wawa’s point-of-sale (POS) terminals in the six states where it operates.

The breach lasted from April 2019 to December 2019 and compromised 34 million credit and debit cards. Wawa said it is cooperating with the affected states and will continue to work to protect its information security systems.

“Wawa is pleased to have reached a settlement with the attorneys general in the states of Delaware, New Jersey, Pennsylvania, Florida, Maryland, Virginia and the District of Columbia related to a data security incident that Wawa announced in 2019,” the company said in a statement. “As noted in the settlement, Wawa responded promptly and complied with all notification requirements with the appropriate authorities, in addition to fully cooperating with the attorneys general and all law enforcement officials to assist all those affected by the incident.”

Based in Pennsylvania, Wawa has more than 850 stores that are popular in the Mid-Atlantic states and Florida.

The Maryland Attorney General’s Office will receive more than $483,000 from Wawa. The money can be used for consumer protection and education, to monitor the implementation of the agreement and for other purposes at the discretion of state prosecutors, according to the settlement documents.

As with other consumer protection and data breach settlements, the money goes from Wava to the state attorney’s office.

“Our office remains committed to protecting the data security of all Marylanders,” said state Attorney General Brian Frosh. “Our laws require companies to protect their customers’ personal information. We will continue to comply with these laws to protect this personal information from unlawful use or disclosure.

The settlement calls for Wawa to pay more than $2.5 million each to the attorneys general of Pennsylvania and New Jersey, more than $1.1 million to Florida and more than $682,400 to Virginia.

“Hackers are working hard to steal personal information — often targeting businesses to gain access to the data of millions of consumers. It’s important that companies take reasonable steps to protect their customers from data breaches,” Moody’s said in a statement. “Through the multi-state action, we are securing millions of dollars and an agreement that Wawa will take steps to better protect the sensitive information provided by its customers.”