After Wawa breach, banks reissue thousands of debit, credit cards to customers

At least four banks are proactively reissuing thousands of debit and credit cards in response to the Wawa data breach that exposed customers’ payment card information for roughly nine months.

Citibank said Friday that it will send new Wawa-branded credit cards to affected consumers. Citizens Bank, First National Bank & Trust, and Northfield Bank said they’re reissuing debit cards to their customers, too.

Northfield Bank, which is based in Woodbridge Township, Middlesex County, said 2,000 debit cards have been reissued. The other banks either declined to say or did not respond when asked how many customers would get new cards.

Wawa disclosed a data breach in December that exposed cardholder names, numbers, and expiration dates used in-store and at gas pumps at “potentially all” of its more than 850 stores since March 4. The company said it found malware on its payment processing servers on Dec. 10 and contained it by Dec. 12. Although some Wawa locations might have been unaffected, malware was on most store systems by April 22, CEO Chris Gheysens told customers on Dec. 19.

The convenience store chain, which did not return a request for comment Friday, has said that it notified payment card companies after finding the malware. An investigation into the breach is continuing.

“We apologize deeply to our customers for this incident and want to reassure them they will not be responsible for fraudulent charges due to this incident,” Wawa spokesperson Lori Bruce said earlier in a statement.

The company has told customers to closely review account statements for unauthorized charges. Under federal law, customers who notify their card company of fraudulent charges won’t have to pay them.

Citizens Bank, which has 1,100 branches in 11 states, said it is reissuing debit cards to customers who may have been affected by the Wawa breach. A spokesperson declined to say how it identifies potentially affected cards.

“Generally, when a merchant has a significant data compromise, we are also notified by the associations [i.e. Visa or Mastercard] of the incident and immediately take steps to identify customers who may have been impacted,” Citizens Bank spokesperson Rory Sheehan said. “These customer accounts are monitored closely and cards are reissued.”

First National Bank & Trust Co., based in Newtown, Bucks County, notified customers on its website that they will receive new cards because of the Wawa breach. A bank official said no one could speak to a reporter Friday, noting that “we don’t generally talk to newspapers.”

Wawa offers a private label credit card that gives customers a discount at the fuel pump. Citibank, the issuing bank for the Wawa-branded card, said it would proactively reissue cards to affected customers.

Not all banks are automatically reissuing cards. Chase, BB&T, Ocean First, PNC, TD Bank, and Wells Fargo said they are handling concerns on a case-by-case basis. A WSFS spokesperson did not return requests for comment.

Wawa is offering to pay for a year of identity-theft protection and credit monitoring for affected consumers who visit experianidworks.com/credit or call 1-844-386-9559 (activation code: 4H2H3T9H6).