The Wendy’s Co. on Thursday acknowledged that an October 2015 attack on point-of-sale systems at franchisee-owned locations is far more widespread than initially reported, affecting 1,025 locations overall. 
 
 The Dublin, Ohio-based burger chain said that malware installed on terminals in several states targeted customers’ payment card data, including their name, debit or credit card number, expiration date, cardholder verification value and service code. 
 
 The list of affected restaurants, to be posted on the company’s site, was not yet available. 
 
 “We sincerely apologize to anyone who has been inconvenienced as a result of these highly sophisticated, criminal cyberattacks,” Wendy’s CEO Todd Penegor wrote in a letter to customers. 
 
 “We have conducted a rigorous investigation to understand what has happened and we are committed to protecting our customers and keeping you informed.” 
 
 The 1,000 restaurants represents less than one in five domestic Wendy’s locations — there are 5,144 franchise-operated domestic units, plus another 582 company-owned locations. 
 
 Wendy’s described the security breach as a pair of attacks. The first, according to the company, started at some franchisee locations in late fall, was first reported in January and affected less than 300 locations. 
 
 But in June the company said that, during its investigation, it discovered a second malware attack, similar to the first, which affected many more than 300 locations. The 1,000 number is the first quantification of the restaurants affected by the dual attacks. 
 
 Wendy’s is offering one year of fraud consultation and identity restoration services to customers who used a payment card at a potentially affected restaurant during the time it might have been affected. 
 
 “In a world where malicious cyberattacks have unfortunately become all too common for merchants, we are doing what is necessary to protect our customers,” Penegor wrote. “We will continue to work diligently with our investigative team to apply what we have learned from these incidents and further strengthen our data security measures.” 
 
 Wendy’s believes that criminals gained access to point of sale terminals by gaining remote access to the system by using compromised credentials from third party service providers. 
 
 That gave the criminals’ access to the central system, enabling them to place malware onto the terminals that read the credit card information. 
 
 The company says the attack has only affected franchisee outlets and not the 582 company locations. That’s important because Wendy’s is shifting to a single point-of-sale system, called Aloha, that’s installed at company-owned units. 
 
 Wendy’s said it worked with investigators to disable the malware. 
 
 Correction: July 8, 2016 This story has been edited to clarify wording on when the attack on Wendy's POS system occurred: The attack did not occur a year ago. A Wendy's spokesman said the earliest evidence of malware present was in October 2015, and this attack was discovered in January 2016. 
 
 Contact Jonathan Maze at [email protected] 
 
 Follow him on Twitter at @jonathanmaze ||||| Wendy's said hackers were able to steal customers' credit and debit card information at 1,025 of its U.S. restaurants, far more than it originally thought. 
 
 The hamburger chain said Thursday hackers were able to obtain card numbers, names, expiration dates and codes on the card, beginning in late fall. Some customers' cards were used to make fraudulent purchases at other stores. 
 
 Wendy's Co. urged customers to check their accounts for any fraudulent purchases. 
 
 The Dublin, Ohio, company first announced it was investigating a possible hack in January. In May, it said malware was found in fewer than 300 restaurants. About a month later, it said two types of malware were found and the number of restaurants affected was "considerably higher." 
 
 There are more than 5,700 Wendy's restaurants in the U.S. 
 
 Customers can see which locations were affected through the Wendy's website . The company said it is offering free one-year credit monitoring to people who paid with a card at any of those restaurants. 
 
 —————— 
 
 ONLINE: 
 
 Wendy's data breach information: https://www.wendys.com/en-us/about-wendys/the-wendys-company-updates 
 
 Wendy's impacted restaurant search: https://payment.wendys.com/paymentcardcheck.html ||||| Image copyright Getty Images 
 
 Popular US food chain Wendy's has been hit by a massive cyber attack, the company has confirmed. 
 
 The company reported suspicious activity earlier this year, but the scale of the breach is far bigger than first anticipated. 
 
 At least 1,025 of its restaurants were targeted - with debit and credit card information stolen. 
 
 The company did not speculate how many people may have been affected, though it did say all of the locations were in the US. 
 
 Malware - malicious software - had been installed on point-of-sale systems in the affected locations. 
 
 The chain said it was confident the threat had been removed, and was now offering help to customers who may have been affected. 
 
 Help includes the offer of one year of "complimentary" fraud protection services. 
 
 Suspicious activity 
 
 In a statement outlining the details of the attack, Wendy's said the malware could have been operational in its restaurants from as early as Autumn 2015. 
 
 Suspicious activity was noticed in February of this year. The company went public with this discovery in May - saying it believed around 300 restaurants had been affected. 
 
 But with the number rising to more than 1,000, this hack ranks among one of the most significant in US history. 
 
 The Wendy's hack bears some similarity to the attack on Target in 2013. In that breach, around 40 million customers' details were stolen via malware installed on point-of-sale computers. 
 
 Wendy's has blamed a third-party for the intrusion, saying a "service provider" that had remote access to the till systems was compromised. 
 
 The company did not say who that service provider was, nor did it explain why it had remote access to the tills of 1,025 of the firm's 5,700 restaurants. 
 
 The company has set up a page for customers to check if a restaurant they bought food from has been affected. 
 
 'Hungry for burgers' 
 
 Security researcher Graham Cluley said it is unlikely that many of those affected will be aware they are at risk. 
 
 "For most of us it's not a red letter day if we go to somewhere like Wendy's," he said. 
 
 "And people won't have registered which one they went to and where they were in the country when it happened." 
 
 He also predicted that while the breach may be embarrassing for the firm in the short term, the company would most likely recover quickly. 
 
 "I think the average guy on the street has a fairly short memory when it comes to a data breach. 
 
 "When you have the choice of walking to Wendy's which is five yards away, or you walk somewhere else 200 yards away. I think you'll just go to Wendy's. 
 
 "I'm pretty sure people will just be hungry for burgers again." 
 
 Follow Dave Lee on Twitter @DaveLeeBBC and on Facebook
– Wendy's has apologized and offered help to customers affected by a massive cyberattack that has affected nearly one in five of its restaurants nationwide. The company says credit and debit card data was stolen by malware in payment terminals at 1,025 US locations, all of them franchisee-owned, Restaurant News reports. The data theft began in late fall last year, Wendy's says. The chain has urged customers to check their statements for possible fraudulent purchases and has set up a website for people to check whether a Wendy's restaurant they visited has been affected by what the BBC describes as one of the most significant hacks in US history. Wendy's announced earlier this year that it was investigating malware in around 300 stores, but it later discovered that the hack was much more wide-ranging than it thought, the AP reports. The company says the hackers were able to obtain card numbers, names, expiration dates, and codes, some of which were used to make fraudulent purchases elsewhere. Security researcher Graham Cluley warns that many victims won't realize they're at risk. "For most of us, it's not a red letter day if we go to somewhere like Wendy's," he tells the BBC. "And people won't have registered which one they went to and where they were in the country when it happened." The assistance Wendy's is offering affected customers includes free credit monitoring for a year.