International Dairy Queen Inc. said computers at 395 of its 4,500 U.S. locations were infected for a period of time with malware that may have compromised some customer information.
Eighteen stores in Minnesota were affected, most for the better part of August, according to the company.
Edina-based Dairy Queen made the announcement after more than a month of investigation into possible malware attacks. The company said it worked closely with franchisees, law enforcement officials and the brands of payment cards affected by the cyberattacks to determine the nature and extent of the breach.
"The time periods during which the Backoff malware was present … vary by locations," a Dairy Queen release said.
The hacked computer systems contained the names of payment card customers, as well as card numbers and expiration dates. The company says it has no evidence that Social Security numbers or personal identification numbers were stolen.
Dairy Queen spokesman Dean Peters said the company does not collect that information from payment card customers when they make a purchase. The names, card numbers and expiration dates that are collected are encrypted immediately, Peters added.
According to the company, the cyber breach came as the result of a third-party vendor's computer credentials being hacked and used to enter the Dairy Queen system. That scenario is similar to the way cyber thieves gained access to financial information for about 70 million Target Corp. customers last year.
Thursday's news came after Dairy Queen made a general announcement of the cyber breach in August. Since then, outside forensic experts worked with company personnel to determine specifics.
