Digital Transactions Authoritative, insightful and timely information for payments professionals
The convenience-store chain Wawa Inc. announced Monday it settled a class-action lawsuit stemming from a data breach in 2019 that was related to malware discovered on its payment-processing servers. The settlement, which is subject to court approval, resolves all customer claims related to the data breach.
The malware affected customer payment card information used at most of Wawa’s locations beginning March 4, 2019, and until the breach was contained on Dec. 12, 2019. Wawa has more than 630 convenience stores, 360 of which have gas pumps, in Pennsylvania, New Jersey, Delaware, Maryland, Virginia, and Florida.
Customers who used a credit or debit card at Wawa stores or fuel pumps can participate in the settlement and obtain Wawa gift cards capped at $8 million in aggregate, and cash reimbursements of out-of-pocket costs capped at $1 million in aggregate. The settlement also requires Wawa to implement and continue to maintain significant enhancements to its data-security measures. No further information about the additional security measures was provided.
The settlement provides compensation to three types of consumers represented in the class: consumers who used their cards at Wawa locations during the breach and did not experience fraudulent charges on their cards, but spent time monitoring their payment card or other accounts; those that experienced fraudulent charges on their cards; and those that incurred out-of-pocket costs as a result of the data breach.
“We feel this settlement is an excellent result for the class, providing a range of benefits to consumers,” legal counsel representing litigants in the class says in a prepared statement. “The settlement also provides valuable remedial relief aimed at preventing similar breaches in the future.”
For its part, Wawa says it is committed to honoring and protecting the trust its customers have in its brand. “We are focused on a timely resolution for Wawa customers who may have been affected by this incident, and this settlement allows us to do just that,” the company says in a prepared statement “We can assure you that we … will work diligently to protect your information and enhance our cybersecurity resiliency.”
Wawa, which would not comment beyond its prepared statements, serves more than 400 million customers annually, according to the company’s Web site.
