Wawa: Anatomy of a Huge Retail Security Breach

By David Gewirtz

Oddly enough, if it weren’t for Irma, a Category 5 hurricane, our credit card information would right now be for sale as part of the BIGBADABOOM-III card dump on the credit card trading site Joker’s Stash.

It’s been almost two and a half years since we last had the delicious, warm pretzels sold by Wawa. Wawa is what 7-Eleven would be if you crossed it with the Keebler elves and genuine magic. Wawa makes fabulous pretzels, incredibly satisfying sandwiches, wonderful baked goods, and tasty, hot macaroni and cheese.

If you’re fortunate enough to shop at a Wawa in New Jersey, you can also get filling macaroni and beef, but for whatever reason, they don’t sell that in their Florida stores. I’m not bitter.

When we got married and moved from New Jersey to Florida in 2005, one of the things we missed most was our neighborhood Wawa. When one finally arrived in our Florida town, it was a cause for celebration and regular pilgrimages.

But in 2017, my wife and I got fed up with being blasted back to the Stone Age every year with the annual hurricane threat. With Irma bearing down on our home, we evacuated and eventually moved across the continent to Oregon. Unlike Florida, which is mostly flat and lined with palm trees, we have great, giant tall trees and huge mountains. But we don’t have Wawa.

That’s fortunate — at least for us. Back in March of 2019, Wawa got hacked. Its point of sale terminals at all its stores were infected by data gathering malwar...