Zippy’s Restaurants has settled a class-action lawsuit involving a breach of credit and debit card systems over four months from Nov. 23, 2017 to March 29.

The company alerted its customers April 27 of the data breach at its 25 restaurants, Napoleon’s Bakery, Kahala Sushi and Pearl City Sushi locations. It also said cards used to buy drinks at Dole Cannery Pomaikai Ballrooms also may have been affected.

Two people, who say they were victims of fraudulent charges after the breach, filed the complaint against Zippy’s owner FCH Enterprises Inc.

Oahu resident Joshua Bokelman said in the lawsuit that he used his debit card nearly exclusively at Zippy’s Express in the Waimalu Shopping Center and incurred more than $300 in fraudulent debit card charges since the breach. Suchandra Thapa of Illinois said he used his credit card at Zippy’s McCully on Feb. 4 and fraudulent charges appeared 17 days later.

An investigation by the Federal Bureau of Investigation discovered that FIN7, an international criminal group responsible for hacking national restaurants and retailers, had accessed card information from the popular local restaurant chain.

Zippy’s said it has improved system security and monitoring of payment processing, among other changes, to prevent a future incident.

“Zippy’s is committed to making things right for our customers impacted by this incident,” said Paul Yokota, president of FCH Enterprises, in a news release. “While we’re grateful that no personal information was exposed in the attack, we continue to recommend that customers closely monitor their credit or debit card statements, and immediately contact their bank or financial institution if they identify any suspicious activity.”

U.S. customers who used a credit or debit card during the breach period may file a claim. The amount paid depends on whether patrons can prove unauthorized charges “plausibly connected to the security incident” and on how many people submit valid claims.

Following the deadline to submit a claim on June 2, Zippy’s will donate any unclaimed settlement funds to Cyber Hawaii, a local nonprofit that works to mitigate cyber risk. For more information or to file a claim go to zippyssettlement.com or call 888-906-2033.