Your craving for chain-restaurant baby back ribs may have caused your credit card information to get stolen by hackers.
Brinker, the parent company of popular dining joint Chili’s, revealed in a statement on Saturday that a “data incident” at some of its restaurants led to a credit and debit card breach. The company said it discovered the issue on May 11 and is now investigating with law enforcement and third-party forensics experts. It’s believed the malware affected customers who dined out between March and April of this year, though the full extent of the attack has not yet been determined.
“We sincerely apologize to those who may have been affected and assure you we are working diligently to resolve this incident,” Brinker International said in its statement.
Brinker did not say which restaurants were involved in the attack and does not know how many customers had their payment data stolen. It did say the attack “did not affect all guests,” a relief given Brinker owns 1,600 Chili’s locations worldwide.
It’s also not clear how the attack was launched, but it appears malware was used to scrape payment information alongside cardholder names from point-of-sale systems used for in-store purchases. Fortunately, social security numbers, full dates of birth, and federal or state ID numbers were not affected by the breach as Chili’s does not collect this info.
Customers are being asked to keep an eye on their credit and debit card accounts and to notify their bank if they notice any suspicious activity. For those who ate at the restaurant during the months the attack was active, Chili’s recommends adding a fraud alert statement to your credit file or placing a freeze on your account “out of an abundance of caution.”
“Law enforcement has been notified of this incident and we will continue to fully cooperate. We are working to provide fraud resolution and credit monitoring services for those guests who may have been impacted,” Brinker International said. Chili’s did not specify the steps it took to remove the malware but says it has “no reason to believe” it’s still in use.
The Tex-Mex restaurant is the latest in a long line of retailers hit by POS malware attacks, none more devastating than the malware that affected an estimated 110 million Target customers in 2014, or about one-third of the U.S. population. To its credit, Chili’s, unlike other retailers hit by cyberattacks, warned its customers the same day it became aware of potential problems.
If you’ve dined at a Chili’s recently, you can read a full list of suggested actions to take to protect your payment info here.