The breach appears to have affected customers who used their debit or credit cards between Aug. 12 and Dec. 4, the company said. The company first received word about the incident Nov. 3 from its card processor, the Dallas-based CM Ebar, LLC, which owns the chain, said in a statement.

"Based upon an extensive forensic investigation, it appears that unauthorized individuals installed malicious software on our payment processing systems at certain locations designed to capture payment card information," the statement read.

CM Ebar, LLC, added it is treating the issue as a top priority and has taken steps to address the situation.

The malware may have corrupted names, payment card account numbers, card expiration dates and verification codes but not Social Security numbers, addresses or similar information.

"We have disabled the malware and have reconfigured our point-of-sale and payment card processing systems to enhance the security of these systems," the statement continued. "In addition, we are in contact with law enforcement and will continue to cooperate with its investigation. We are also coordinating with payment card companies."

"For businesses to protect customer and business data from hackers, sometimes it's simply a matter of ensuring all the data from end-to-end is encrypted," endpoint security expert Michél Bechard said. Bechard is the director of service provider technologies at the Clifton, N.J.-based cybersecurity company Comodo. "In the case of a POS system breach, if encryption can't be utilized, then additional endpoint security technologies like containment can be implemented, which wrap the application and transaction in a protective bubble and ensure every POS system that uses the technology is protected from hacking attempts."

Kevin Watson, CEO of the Houston-based Netsurion, a provider of remotely-managed security services for multi-location businesses, added, "Hackers make a lot of money from stealing credit cards because they are the easiest targets. If companies want to know what they should be doing to prevent breaches like the Elephant Bar, the answer is – do not allow your network security posture to be relegated to a secondary function of an IT administrator. A really crucial consideration, especially in the case of POS system malware, is also securing the data that leaves your network. A business' outbound security policy is its last defense against a data breach."