MalwareRetail & ConsumerRetailRansomwareData ExfiltratedCustomer Data InvolvedPCIFinancial accountLowContained

WAWA, INC.

bd_39e3080c2f5ba509 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 10, 2019

Filed

Dec 19, 2019

To disclose

9 days

Affected

Not disclosed

Linked

6 filings

Confidence

64%

Full breach record for WAWA, INC. →2 incidents on file

Wawa, Inc. disclosed a data breach involving malware on payment processing servers from March 4, 2019, to December 12, 2019. The incident compromised PCI data (card numbers, expiration dates, names) for customers using payment terminals. Wawa engaged forensic investigators, notified law enforcement, contained the malware, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 281 days

discovery → filing · 9 days

Mar 4, 2019

Begins

Dec 10, 2019

Discovered

Dec 19, 2019

Filed

vs. sector median

6 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_41ddba7e669774342019-12-19Verified
Massachusetts State AGbd_912dd3b3ba52e01b2019-12-19Verified
Delaware State AGbd_a570021cb784d84d2019-12-19Verified
Oregon State AGbd_b7c61660b28b85472019-12-19Verified by operator

Show 1 more filing ↓up to 4d gap

South Carolina State AGbd_6b56a55be8d6f92e2019-12-23 · +4dVerified

Name: WAWA, INC.
norm: wawa
Domain: wawa.com

Name: WAWA, INC.
norm: wawa
Domain: wawa.com
Industry: Retail & Consumerllm

Discovered: Dec 10, 2019
Breach occurred: Mar 4, 2019 – Dec 12, 2019
Undetected for: 281 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 19, 2019
Affected individuals: Not disclosed
Data types: PCIFinancial account
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement

During the incident: Engaged a leading external forensics firm to support our response efforts
Notified law enforcement and payment card companies
Blocked and contained the malware
Arranged for a dedicated toll-free call center
Offered credit monitoring and identity theft protection without charge
Changes made: Taking steps to enhance the security of our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 days(9 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

California State AGDec 19 · first

Massachusetts State AGDec 19 · first

Delaware State AGDec 19 · first

Oregon State AGDec 19 · first

Montana State AGDec 19 · first · this page

South Carolina State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/CON-CON-4.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 19, 2019
Raw hash: 050ee421190c046603981a1886410b6c91b589236c380b104f1ae8eda4ec2a19

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityWAWA, INC.

Victim entityWAWA, INC.

Incidentdiscovered Dec 10, 2019

Stated responseEngaged a leading external forensics firm to support our response efforts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov