US-based quick service restaurant (QSR) chain The Krystal has reported a data security breach that involved payment card information of certain customers.
The incident is believed to have occurred between July through to September 2019. It may have potentially affected guests who made purchases through the company’s payment processing systems at certain restaurant locations.
The restaurant chain has hired a forensics firm to conduct a thorough investigation to understand the incident, which is currently conducting an investigation to determine the extent of impact the data breach has on its systems.
According to the company, the investigation is in its early stages, and it has learned that the security incident may have involved payment cards processed by a payment processing system at certain locations. About a third of restaurants are identified to be impacted by this incident to date.
The QSR chain has also notified law enforcement of the incident as well as the payment card networks of the investigation. It will continue to fully cooperate with law enforcement throughout the investigation process.
In its statement, the company said: “Krystal is committed to protecting the privacy and security of our customers and will continue to take quick action.
“While our investigation continues, we would like to remind all of our guests to be vigilant and that it is always good practice to review their payment card statements regularly and report any unusual or unauthorised purchases to their financial institution.”
The company currently operates multiple payment processing systems, and noted that not all restaurants have been impacted by this incident.
In addition, Krystal is currently working to determine the specific locations and dates for each restaurant involved in the incident.
Based in Chattanooga, Tennessee, Krystal currently operates approximately 320 restaurants in ten US states.
In May this year, The QSR chain selected customer analytics firm Buxton to support expansion across the country.