Wawa paid roughly $48.5 million across three separate settlements over its 2019 payment card data breach: about $28.5 million for banks and credit unions, $12 million for consumers, and $8 million to a group of state attorneys general. Consumers who filed valid claims by the November 29, 2021 deadline started receiving $5 or $15 Wawa eGift cards by email on November 19, 2025, with a smaller group eligible for up to $500 cash for documented out-of-pocket losses.1NJ1015. Wawa Data Breach Settlement2C-Store Dive. Wawa to Pay Up to $28.5M in Data Breach Settlement
What the Breach Exposed
Malware sat on Wawa’s payment processing servers from March 4, 2019 through December 12, 2019, capturing credit and debit card numbers, expiration dates, and cardholder names from register and fuel pump transactions at nearly all of Wawa’s roughly 850 East Coast locations.3Justia. In Re Wawa Inc Data Security Litigation4Philadelphia Inquirer. Wawa Data Breach Cards for Sale on Dark Web5WilmerHale. $8 Million Multistate Settlement Resolves Data Breach
Wawa announced the breach on December 19, 2019 and offered a year of free credit monitoring and identity-theft protection.4Philadelphia Inquirer. Wawa Data Breach Cards for Sale on Dark Web Fifteen consumer lawsuits were consolidated in the Eastern District of Pennsylvania as In re Wawa, Inc. Data Security Litigation, No. 2:19-cv-06019.3Justia. In Re Wawa Inc Data Security Litigation
The Consumer Settlement
Judge Gene E.K. Pratter granted final approval to the consumer deal on April 20, 2022. It was valued at $12 million overall, with up to $9 million for direct benefits to class members and a Wawa commitment of at least $35 million toward cybersecurity upgrades.6Law360. Wawa Gets Nod for $12M Consumer Data Breach Settlement
The class covered every U.S. resident who used a credit or debit card at any Wawa store or fuel pump between March 4 and December 12, 2019. Out of an estimated 22 million people in the class, about 564,000 filed claims, a claim rate of roughly 2.56%.3Justia. In Re Wawa Inc Data Security Litigation
The Three Payment Tiers
Compensation depended on what a claimant could show:
- Tier 1, a $5 Wawa gift card, went to customers who used a card during the breach period, had no fraud, and spent time monitoring accounts. Up to $6 million was set aside for this tier.
- Tier 2, a $15 Wawa gift card, covered customers who could document actual or attempted fraudulent charges that their bank reversed. Up to $2 million was allocated here.
- Tier 3 paid up to $500 in cash to customers with documented out-of-pocket losses tied to the breach, funded up to $1 million.
76abc. Wawa Data Breach Claim Form Settlement Gift Cards8NBC Philadelphia. How To File a Claim if You Were Affected by Wawa’s Data Breach
The Gift Card Emails Arriving Now
Payments to Tier 1 and Tier 2 claimants started going out on November 19, 2025. The emails carry the subject line “Wawa Settlement eGift Card” and are legitimate, though many recipients assumed they were phishing. To claim the card, click the link in the email; the digital gift card can then be printed for in-store use or added to the Wawa mobile app.1NJ1015. Wawa Data Breach Settlement9Jersey Shore Online. Wawa Settlement Emails Contain Legitimate eGift Cards
If You Never Filed a Claim
The claim deadline was November 29, 2021, and the opt-out deadline was November 12, 2021.76abc. Wawa Data Breach Claim Form Settlement Gift Cards Customers who did not submit a timely claim are not receiving a gift card or cash payment from this settlement. The eGift card emails only reach people whose claims were approved.
The Bank and Credit Union Track
Financial institutions that had to cancel and reissue compromised cards recovered separately in the same case, led by Inspire Federal Credit Union, Insight Credit Union, and Greater Cincinnati Credit Union.2C-Store Dive. Wawa to Pay Up to $28.5M in Data Breach Settlement Wawa agreed to fund up to $28.5 million in institution claims, plus up to $9 million for notice, administration, attorneys’ fees, and service awards of up to $10,000 for each named plaintiff.10Wawa Financial Institution Settlement. In Re Wawa Inc Data Security Litigation Financial Institution Track
Eligible institutions were issuers of payment cards (other than American Express) used at Wawa during the breach window and flagged as compromised through Visa, MasterCard, or Discover alerts. Claims were split into card replacement costs (capped at $18.5 million, paid at $5 per card), documented fraud losses (capped at $4,000 per claimant and $8 million overall), and a fixed alternative payment for institutions that chose not to itemize. Final approval came on December 9, 2025, with payments expected in the first quarter of 2026.10Wawa Financial Institution Settlement. In Re Wawa Inc Data Security Litigation Financial Institution Track11ABA Banking Journal. Legal Notice
The State Attorneys General Settlement
On July 26, 2022, Wawa agreed to pay $8 million to resolve an investigation by seven state attorneys general and the District of Columbia. The probe was co-led by New Jersey Acting Attorney General Matthew J. Platkin and Pennsylvania Attorney General Josh Shapiro; Florida, Delaware, Maryland, Virginia, and D.C. also participated. New Jersey received $2.5 million of the total.12New Jersey Office of the Attorney General. Acting AG Platkin Co-Leads $8 Million Settlement With Wawa Inc Over Data Breach13Reuters. Wawa to Pay $8 Million in Data Breach Settlement With State AGs
The states alleged Wawa failed to keep reasonable security measures in place. Under the Assurance of Voluntary Compliance, Wawa agreed to build a comprehensive information security program within six months, implement multi-factor authentication and network segmentation of cardholder data, meet Payment Card Industry Data Security Standards, train employees on security, and conduct annual risk assessments. A third-party compliance assessment was required within a year. Wawa did not admit wrongdoing.12New Jersey Office of the Attorney General. Acting AG Platkin Co-Leads $8 Million Settlement With Wawa Inc Over Data Breach
The Total Bill
Wawa’s total exposure across the three settlements came to roughly $48.5 million: $28.5 million for financial institutions (plus up to $9 million in related costs), $12 million for consumers, and $8 million for the multistate agreement. On top of those payments, Wawa committed to at least $35 million in cybersecurity improvements.2C-Store Dive. Wawa to Pay Up to $28.5M in Data Breach Settlement No criminal charges against the individuals behind the breach have been publicly reported.