Technology & Automation

Gas Station Cybersecurity: Protect POS, Dispensers & Data

April 14, 2026|Updated September 8, 2026|10 min read

Padlock and keys resting on a computer keyboard.

Known errors in this article have been corrected.

A full claim-by-claim review is still pending. Confirm any figure with your state program before acting on it. Last verified 2026-09-08. Not legal advice.

Why Gas Stations Are High-Value Cybersecurity Targets

Fuel retail operations process high volumes of card transactions, run legacy embedded systems across forecourts, and often operate with lean IT support — a combination that makes them attractive targets for cybercriminals.

The threat isn’t theoretical. Physical and network-based skimming at fuel dispensers is a recurring, well-documented form of payment fraud in the United States, and point-of-sale (POS) malware and ransomware attacks have also hit fuel retailers — including mid-sized chains that assumed they were too small to be worth targeting.

Whether you operate a single-site independent station or a regional network of 20+ locations, understanding your attack surface is the first step toward building a defensible operation.

Understanding Your Attack Surface: Three Critical Layers

1. Fuel Dispenser Systems

Modern dispensers from Gilbarco Veeder-Root (Encore series) and Dover/Wayne (Ovation series) run embedded operating systems and communicate back to the POS controller via internal network protocols. Older Wayne CAT and Gilbarco Advantage units — still common in independent stations — may run on unsupported firmware with no manufacturer patch support.

Physical threats include Bluetooth-enabled skimmer overlays and internal card reader replacements fitted inside the dispenser cabinet. Network threats include man-in-the-middle attacks on dispenser-to-controller communications if the internal LAN is not properly segmented.

The EMV (chip card) liability shift for automated fuel dispensers took effect in April 2021 (Visa on 17 April, Mastercard on 16 April). It is a card-network chargeback rule written into the payment brands’ operating regulations, not a government mandate: where the dispenser card reader cannot accept a chip card, counterfeit-card chargebacks fall on the merchant rather than on the card issuer. A station still running magnetic-stripe-only dispenser readers carries that liability on every transaction.

2. Point-of-Sale Systems and Back-Office Controllers

The inside POS environment — typically a Verifone Commander, Gilbarco Passport, or Wayne iX Pay terminal setup — sits at the center of your payment processing ecosystem. These systems handle card authorization, loyalty programs, carwash controls, and increasingly, age-verification for tobacco and lottery sales.

POS security vulnerabilities commonly exploited in fuel retail include:

Default vendor passwords never changed during installation
Remote access software (pcAnywhere, TeamViewer, RDP) left exposed to the public internet
Out-of-date operating systems — installations still running Windows 7 or Windows Embedded POSReady 2009, both past Microsoft end-of-support
Flat networks where the POS shares broadcast traffic with employee devices and customer Wi-Fi
Unencrypted payment data in transit between the controller and payment processor

Verifone and Gilbarco Veeder-Root both issue security bulletins and firmware updates for their controller platforms. Failing to apply these updates in a timely manner is one of the most common findings in post-breach forensic investigations.

3. Back-Office and Network Infrastructure

Broadband routers, wireless access points, surveillance DVR systems, and ATG (Automatic Tank Gauge) controllers from Veeder-Root (TLS-450PLUS) or Franklin Fueling Systems all represent network-connected endpoints that, if compromised, can serve as pivot points into payment systems. Veeder-Root TLS systems in particular have been the subject of multiple security research disclosures regarding internet-exposed ATG ports — a finding that directly affects UST compliance data integrity as well as cybersecurity posture.

Regulatory Framework: What the Rules Actually Require

PCI DSS 4.0.1: The Payment Card Industry Standard

The Payment Card Industry Data Security Standard (PCI DSS) is the primary compliance framework governing gas station data breach prevention. Version 4.0 was released in March 2022 and retired on December 31, 2024. Version 4.0.1, published June 11, 2024, is now the only active version; it is a limited revision that adds and removes no requirements and did not move the March 31, 2025 date on which the future-dated v4.0 requirements became mandatory. The changes most relevant to fuel retailers are:

Requirement 6.3.3: All system components must be protected from known vulnerabilities by installing applicable security patches; critical or high-security patches must be installed within one month of release, and all other applicable patches within a time frame the entity defines
Requirement 7.2.4: All user accounts and related access privileges, including third-party and vendor accounts, must be reviewed at least once every six months
Requirement 12.3.1: Each PCI DSS requirement that lets the entity choose how often it is performed must be supported by a documented targeted risk analysis
Requirement 11.6.1 (new in 4.0): A change- and tamper-detection mechanism must alert personnel to unauthorized modification of the HTTP headers and the contents of payment pages as received by the consumer browser — applicable to web-based ordering and any browser-delivered payment page, not to the dispenser card reader

Non-compliance with PCI DSS does not carry direct government fines. Card brand fines, acquirer penalties and PCI non-compliance assessments are private contractual terms between the card networks, your acquiring bank and you; no schedule of amounts is published. Whatever your acquirer is assessed is passed through to you under your merchant agreement, and after a confirmed breach you may also have to fund a forensic investigation and card reissuance. The only reliable figures are the ones in your own merchant agreement — ask your acquirer for them in writing.

State Data Breach Notification Laws

All 50 U.S. states have enacted data breach notification laws. Thresholds, deadlines and penalties differ from state to state and are amended frequently: some states set a fixed number of days from discovery, others require notice without unreasonable delay, and several add attorney general or consumer reporting agency notification. Your obligation is set by the statute of every state where an affected resident lives, not only by the state your station sits in, so confirm the current statutory text with counsel before you notify.

FTC Safeguards Rule

The Federal Trade Commission’s updated Safeguards Rule (16 CFR part 314) — several provisions of which carried a compliance deadline of June 9, 2023 — applies to non-banking financial institutions. The rule is explicit that a retailer is not a financial institution merely because it accepts payment in the form of cash, checks or credit cards that it did not issue, so taking payment cards at the pump does not by itself bring a station under it. A fuel retailer that extends credit itself — for example by issuing its own credit or fleet card directly to customers — is engaged in a financial activity and can be covered, in which case the rule requires a written information security program, a qualified individual to oversee it, and written risk assessments. Under 16 CFR 314.6, an institution that maintains customer information on fewer than 5,000 consumers is exempt from several of those written requirements.

Practical Security Controls for Fuel Retailers

Network Segmentation: Your Most Important Control

The single highest-impact action most gas station operators can take is properly segmenting their network. Your POS and dispenser communication network should exist on an isolated VLAN with no direct routing to employee devices, office computers, or customer Wi-Fi. A properly configured firewall — not a consumer-grade router — should govern all inter-VLAN traffic.

Many fuel retail technology vendors, including Gilbarco and Verifone, publish network architecture guides specific to their controller platforms. Your petroleum equipment contractor or point-of-sale dealer should be able to implement a segmented architecture during any major system refresh.

Dispenser Physical Security Checklist

✅ Inspect all dispenser card readers weekly for skimmer overlays (look for misaligned bezels, unusual resistance when inserting card, extra components)
✅ Apply tamper-evident security seals to all dispenser cabinet access panels and log inspection dates
✅ Enable Bluetooth scanning alerts if your dispenser management software supports it (encrypting card readers make the data an overlay skimmer captures far less useful, but do not remove the need for physical inspection)
✅ Upgrade to EMV-capable card readers on all dispenser lanes if not already completed
✅ Review dispenser access logs for unauthorized cabinet opens

POS System Hardening

✅ Change all default passwords immediately on installation and rotate quarterly
✅ Disable or remove remote access tools not actively managed by your VAR or POS provider
✅ Apply vendor-issued firmware and OS patches promptly — PCI DSS requires critical and high-security patches within one month of release, and other applicable patches within a time frame you define and document
✅ Enable point-to-point encryption (P2PE) on all payment terminals — both countertop and pay-at-pump
✅ Ensure your payment processor relationship includes tokenization so card data is never stored on-site
✅ Review who has administrative POS access; remove terminated employee credentials immediately

Employee Training and Insider Threat

Many breaches involve an insider element — whether malicious or negligent. For fuel retail, this often means an employee clicking a phishing link on a shared back-office computer, or a contractor being given unnecessary network access during a service call.

Establish a written acceptable use policy for all business computers. Train employees annually on phishing recognition. For service contractors accessing your network or POS system, create time-limited access credentials that expire automatically after the service window closes.

Incident Response: What to Do When (Not If) Something Goes Wrong

Every gas station operator needs a written incident response plan before a breach occurs. At minimum, your plan should include:

Containment: Isolate affected systems immediately — disconnect compromised devices from the network without powering them off (preserves forensic evidence)
Notification of your payment processor: Call your acquirer’s security hotline within hours of confirmed or suspected compromise
Legal counsel: Engage an attorney with data breach experience before making public statements
Forensic investigation: Your payment brand may require a PCI Forensic Investigator (PFI); do not begin internal remediation that could overwrite evidence
Regulatory notification: Follow your state’s breach notification timeline — document the discovery date precisely
Customer notification: Work with counsel on messaging; most states prescribe minimum content requirements for consumer notices

Pro Tip: Review your general liability and commercial property insurance policies today. Standard policies typically do not cover cyber incidents. A standalone cyber liability policy can cover forensic costs, notification expenses, regulatory defense, and business interruption losses — ask your broker to quote one for your site rather than budgeting from a published figure.

Building a Cybersecurity Roadmap for Your Station

Cybersecurity improvement doesn’t have to happen all at once. Prioritize by risk impact and build a 12-month roadmap:

Priority	Action	Timeline
Critical	Network segmentation (POS/dispenser VLAN)	0–60 days
Critical	EMV dispenser card reader upgrade	0–90 days
High	Enable P2PE on all payment terminals	30–60 days
High	Patch all POS/controller firmware	30 days
Medium	Cyber liability insurance	30–60 days
Medium	Employee security training	60–90 days
Ongoing	Weekly dispenser physical inspections	Immediate

Action Items: Start Here This Week

Audit your network topology today. Draw a map of every device connected to your business network. If your POS, employee computers, and customer Wi-Fi are all on the same network, you have a critical gap to close.
Check your dispenser firmware version. Contact your Gilbarco, Wayne, or other dispenser vendor representative and confirm whether your installed firmware is current and whether your card readers are EMV-capable.
Confirm your PCI compliance status with your processor. Log into your acquirer’s compliance portal and check your current SAQ (Self-Assessment Questionnaire) status and expiration date. The active version is PCI DSS v4.0.1, and the requirements that were future-dated in v4.0 became mandatory on March 31, 2025.
Call your insurance broker. Ask specifically whether your current policy covers cyber incidents. If not, get a cyber liability quote this week.
Schedule a physical dispenser inspection. Walk your forecourt today and inspect every card reader bezel, every cabinet seal, and every keypad for signs of tampering.

Gas station data breach events are not a matter of if — they are a matter of when and how prepared you are. The operators who weather these events with minimal financial and reputational damage are invariably those who treated cybersecurity as ongoing operational practice rather than a one-time project. Start with the basics, document your efforts, and build from there.

Sources

Figures and citations in this article were checked against the following primary sources on 2026-09-08.