Diners at 167 Applebee's restaurants across 15 states may have had their credit card information exposed to hackers, after malware was discovered on the franchise owner's payment systems.
RMH Franchise Holdings says it discovered malware on "point of sale" systems at Applebees stores it owns and operates across 15 states.
"Certain guests' names, credit or debit card numbers, expiration dates and card verification codes processed during limited time periods could have been affected," the company said in a statement.
Many of the restaurant locations had systems affected between early December and early January, the company said, before the malware was discovered on Feb. 13. RMH says it contacted cybersecurity experts and law enforcement after finding it.
The breach only affects point of sale systems at the 167 Applebee's locations owned by RMH, which "operates its point-of-sale systems isolated from the broader Applebee's network," the company says. Applebee's has close to 2,000 locations around the world, according to Dine Brands Global, which says it franchises all restaurants.
RMH says now the "incident has been contained" and customers can use their credit cards at its locations.
Point of sale malware has affected other restaurant chains; Arby's, Chipotle, Shoney's and Wendy's have all recently been hit by attacks, according to Infosecurity Magazine.
Point of sale attacks, which compromise payment systems at restaurants and retailers and can give thieves the ability to steal credit card information from customers, gained more attention after massive hacks of Target in 2013 and Home Depot in 2014.
"It's an industry wide problem as more retailers look to an ecosystem of providers to bring in third party systems like point of sale and inventory management solutions," Fred Kneip of security firm CyberGRX told the security website Threatpost. "As of today a lot of stores are playing catch up with security, and it can take months or years to realize that compromises have happened on third party systems."
RMH advised customers who may have been affected to monitor their credit card statements.
Copyright 2021 NPR. To see more, visit https://www.npr.org.