In late December 2019, fuel and convenience store chain Wawa Inc. said a nine-month-long breach of its payment card processing systems may have led to the theft of card data from customers who visited any of its 850 locations nationwide. Now, fraud experts say the first batch of card data stolen from Wawa customers is being sold at one of the underground’s most popular crime shops, which claims to have 30 million records to peddle from a new nationwide breach.
Now, on the evening of Monday, Jan. 27, a popular fraud bazaar known as Joker’s Stash began selling card data from “a new huge nationwide breach” that purportedly includes more than 30 million card accounts issued by thousands of financial institutions across 40+ U.S. states. Two sources that work closely with financial institutions nationwide tell KrebsOnSecurity the new batch of cards that went on sale Monday evening — dubbed “BIGBADABOOM-III” by Joker’s Stash — map squarely back to cardholder purchases at Wawa.
Exclusive: The 9-month breach last year at Wawa filling stations may have compromised >30 million payment cards, the first batch of which just went up for sale in the cybercrime underground. https://t.co/8J4AgrXifB pic.twitter.com/U4mv40E6mx
— briankrebs (@briankrebs) January 28, 2020
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.