WaWa Exposes Over 30 Million Payment Cards

In late December 2019, WaWa, the US-based convenience store and gas station chain, reported its payment systems had been compromised for a period of 9 months. This compromise resulted in the exposure of over 30 million payment cards. On January 27, 2020, a large bundle of full payment card details was offered for sale on the carding and fraud forum Joker’s Stash. It is highly likely these payment details were exfiltrated from compromised WaWa payment systems.

Recommendations

If you have made a purchase at a WaWa location between March 2019 and December 2019, consider cancelling and replacing payment cards
Continue monitoring the Alpha Team Tab for additional updates on this data breach. If you have specific questions regarding this breach, or on the criminal forums we monitor, reach out to [email protected] for assistance

Details

Joker’s Stash is a criminal fraud forum, where payment card details from various data breaches are offered for sale. The cards are offered for sale individually, with pricing ranging from $50 - $100 on average. When Joker’s Stash replenishes their card offerings, they often publish an announcement on their forum, intended to generate buzz on the site over new card offerings.

Figure 1. Announcement of most recent payment card dump on Joker’s Stash

Most often, payment card data breaches are a result of point of sale, or POS breaches. POS systems are highly attractive targets to attackers because of the payment information that flows through these systems. Despite this, POS systems are particularly vulnerable to malware as they are generally difficult to update, and tend to run old versions of operating systems. For this reason, POS malware can utilize legacy exploits in order to drop additional modules to steal this payment card information.

The payment card drop that likely contains details from the WaWa breach includes full card numbers, cardholder name, and expiration dates. Card PIN numbers and CVV codes were not included in the compromise. For this reason, these cards may be more difficult for would-be fraudsters to use. It is also important to note that the Joker’s Stash dump only includes a portion of the 30 million breached cards. The remainder of card details may be released in waves, or they may never be released at all.