Forest Global Training Partners

Cyber Risks · Krebs on Security

Wawa Breach May Have Compromised More Than 30 Million Payment Cards

Summary: Wawa Inc. disclosed in December 2019 that card-stealing malware had been installed on in-store payment processing systems and fuel dispensers at potentially all 850 of its locations, discovered Dec. 10 and contained Dec. 12 but believed installed around March 4. On Jan. 27, 2020, the fraud bazaar Joker's Stash began selling a batch dubbed "BIGBADABOOM-III" claiming more than 30 million card accounts from 40+ U.S. states, which two sources working with financial institutions tied back to Wawa purchases, with Gemini Advisory reporting the initial release was nearly 100,000 records concentrated in Florida and Pennsylvania.

What's compelling: Nine months of malware across 850 locations produced a claimed 30 million-card batch, and Gemini found U.S. records selling for a median of $17 apiece - while Visa's own data shows counterfeit fraud dollars fell 81 percent at merchants that completed the chip upgrade, a deadline fuel station owners pushed to October 2020.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related