Sonic Drive-In acknowledged Wednesday that a data breach exposed customers’ credit card or debit card numbers to cyber criminals.

According to krebsonsecurity.com, roughly five million credit card accounts were put up for sale on September 18.  The website said financial institutions noticed that a recent pattern of credit or debit card fraud was traced back to cards that were previously used at Sonic. 

In a brief written statement, Sonic said, “The security of our guests’ information is very important to SONIC. We are working to understand the nature and scope of this issue, as we know how important this is to our guests.”

“We immediately engaged third-party forensic experts and law enforcement when we heard from our processor. While law enforcement limits the information we can share, we will communicate additional information as we are able,” Sonic said.