Fast-casual restaurant chain Noodles & Company informed customers on Tuesday that its computer systems have been breached and cybercriminals could have stolen payment card data.
The company, which has roughly 500 restaurants in 35 states across the U.S., launched an investigation on May 17 after its payment processor detected unusual activity on cards used at Noodles & Company locations.
On June 2, investigators discovered a piece of malware and determined that cybercriminals might have been using it to steal customers’ credit and debit card information since January 31. The attackers could have accessed cardholder names, card numbers, expiration dates and CVV numbers.
Noodles & Company has published a list of affected restaurants in each state. There are more than 500 locations on the list, which indicates that a majority, if not all, of the company’s establishments are impacted.
The Secret Service is investigating the incident and forensics experts are trying to determine how the breach occurred. In the meantime, the company says it’s working on implementing additional security features to prevent future attacks.
The restaurant chain has set up a dedicated assistance line for customers who have any questions about the incident. Noodles & Company has also provided recommendations on fraud and identity theft protection, but it’s currently not offering any credit monitoring and protection services to potentially affected individuals.
The company is confident that the malware has been removed from its systems and assured customers that it is safe to use their credit and debit cards at its restaurants. However, as recent incidents have shown, cybercriminals can plant multiple malware variants and some of them could remain undetected for longer periods of time.
Fast food restaurant chain Wendy’s also suffered a data breach recently and the organization initially told customers that only less than 300 of its 5,500 franchised restaurants were affected. Experts later determined that another piece of malware had also been planted on PoS systems and the actual number of affected locations is considerably higher than 300.