Florida Privacy Enforcement Cases

Why the action was brought

Hackers accessed Wawa’s computer network and deployed malware on point-of-sale terminals, extracting customers’ sensitive payment card information from April 18, 2019, through Dec. 12, 2019. The breach potentially compromised up to 34 million payment cards. The attorneys general alleged Wawa failed to employ reasonable information-security measures, violating state consumer protection and personal information protection laws.

Why the action was brought

This action followed findings that Morgan Stanley failed to properly dispose of thousands of hard drives and servers containing customers’ sensitive personal information, hired an inexperienced moving company, failed to monitor equipment sold through internet auctions, and later discovered 42 missing servers potentially containing unencrypted information, exposing millions of consumers.

Why the action was brought

AMCA’s internal system was accessed by an unauthorized user from Aug. 1, 2018, through March 30, 2019, exposing Social Security numbers, payment-card information, and sometimes medical-test names and diagnostic codes. The company failed to detect the intrusion despite bank warnings, potentially jeopardizing identities, finances, and online security of millions.