www.nbcphiladelphia.com ATM Skimming Devices Found at Wawa, 7-Eleven, and CVS in Pennsylvania
Article Content
- •Two suspects installed skimming devices on ATMs in Pennsylvania.
- •One suspect has been identified as Grozea Daragiu from Romania.
- •Victims reported unauthorized withdrawals using cloned cards.
Police are investigating two suspects who placed skimming devices on ATMs at Wawa, 7-Eleven, and CVS locations in Pennsylvania. The incidents began on May 5, 2026, when a customer discovered a cloning device on his card after using a Wawa ATM. Subsequent investigations revealed a second skimming device was found on another Wawa ATM. Victims reported unauthorized withdrawals using cloned cards at Quakertown National Bank. One suspect, Grozea Daragiu, a Romanian national, has been identified, while the second suspect remains unknown. The suspects are believed to have targeted 50 to 100 customers at the Bucks County Wawa alone. Police are urging ATM users to be vigilant and report any suspicious devices immediately.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track 7-Eleven in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical WSO2 API Manager Vulnerability Under Active Exploitation A critical vulnerability (CVE-2026-5430) in WSO2 API Manager is being actively exploited, allowing unauthenticated attackers to forge admin tokens via JWT authentication bypass. This flaw, which has a CVSS score of 10.0, affects multiple WSO2 products including API Manager, Universal Gateway, Traffic Manager, and API… 
Critical Linux Kernel Vulnerability CVE-2025-39682 Under Active Exploitation A critical vulnerability (CVE-2025-39682) in the Linux kernel allows remote code execution through mishandling of zero-length TLS records. This flaw affects kTLS-enabled hosts running vulnerable kernel versions, exposing them to attackers without authentication. CISA added this vulnerability to its Known Exploited…