Posted: November 15, 2019

UPDATED NOTICE OF DATA BREACH

To Our Valued Checkers and Rally’s Guests:

We are providing an update about the malware issue we previously announced on May 29, 2019. Below is information about what happened and what we are doing to further protect our guests’ data. Our guests are our top priority, and we take the protection of their information very seriously.

What Happened?

On May 29, 2019, we notified our guests about the installation of malware on certain point-of-sale systems at some Checkers and Rally’s locations. In October 2019, we became aware of suspected payment card compromise at one additional Checkers and Rally’s location that previously had not been affected by the malware issue. After conducting an investigation with the assistance of leading data security experts, we confirmed that this restaurant was subsequently affected by the same malware issue we reported in May, which enabled an unauthorized party to obtain the payment card data of some guests at this location. We also determined that the unauthorized party re-installed the malware at several of the restaurants we previously identified as being impacted. Our investigation has found that this additional activity is connected to the same actor responsible for the issue we disclosed on May 29, 2019.

A list of the locations affected by this additional activity and their respective estimated dates of exposure is available here. It is important to understand that not all Checkers and Rally’s restaurants were impacted by this issue. In addition, not all guests who visited the listed restaurants during the relevant time periods are affected.

We have taken steps to contain and remove the malware, and are coordinating closely with federal law enforcement authorities in their investigation of this matter.

What Information Was Involved?

The malware was designed to collect information stored on the magnetic stripe of payment cards, including cardholder name, payment card number, card verification code and expiration date. Based on the investigation, we have no evidence that other cardholder personal information was affected by this issue.

What We Are Doing?

After becoming aware of the additional malware activity, we quickly engaged a leading data security firm to launch an extensive investigation and assist us with containing and removing the malware. We also are working closely with federal law enforcement authorities and affected restaurants to address the matter, and are coordinating with the payment card companies in their efforts to protect cardholders. We continue to take steps to enhance the security of Checkers and Rally’s systems.

What You Can Do

If you used a payment card at an affected restaurant during a relevant time period, please consider the following recommendations:

Review Your Account Statements. We encourage you to remain vigilant by reviewing your account statements. If you believe there is an unauthorized charge on your card, please contact your financial institution or card issuer immediately.

We encourage you to remain vigilant by reviewing your account statements. If you believe there is an unauthorized charge on your card, please contact your financial institution or card issuer immediately. Order a Credit Report. You are entitled under U.S. law to one free credit report annually from each of the three nationwide consumer reporting agencies. To order your free credit report, visit www.annualcreditreport.com or call toll-free at 1-877-322-8228.

You are entitled under U.S. law to one free credit report annually from each of the three nationwide consumer reporting agencies. To order your free credit report, visit www.annualcreditreport.com or call toll-free at 1-877-322-8228. Review the Reference Guide and FAQs. The Reference Guide and FAQs provide additional recommendations on the protection of personal information.

For More Information

If you have any questions about this issue, please call 1-833-281-4832, Monday through Friday from 8:00 a.m. to 10:00 p.m. CST and Saturday and Sunday from 10:00 a.m. to 7:00 p.m. CST.

We hope this information is useful to you, and we sincerely regret any inconvenience or concern this may cause our guests.

Sincerely,

Minh Le

Checkers Drive-In Restaurants, Inc.

Chief Information Officer

Reference Guide

Posted: November 15, 2019

If you used a payment card at an affected restaurant during a relevant time period, please consider the following recommendations:

Order Your Free Credit Report. To order your free credit report, visit www.annualcreditreport.com, call toll-free at 1-877-322-8228, or complete the Annual Credit Report Request Form on the U.S. Federal Trade Commission’s (“FTC”) website at www.consumer.ftc.gov and mail it to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281. The three consumer reporting agencies provide free annual credit reports only through the website, toll-free number or request form.

When you receive your credit report, review it carefully. Look for accounts you did not open. Look in the “inquiries” section for names of creditors from whom you haven’t requested credit. Some companies bill under names other than their store or commercial names. The consumer reporting agency will be able to tell you when that is the case. Look in the “personal information” section for any inaccuracies in your information (such as home address and Social Security number). If you see anything you do not understand, call the consumer reporting agency at the telephone number on the report. Errors in this information may be a warning sign of possible identity theft. You should notify the consumer reporting agencies of any inaccuracies in your report, whether due to error or fraud, as soon as possible so the information can be investigated and, if found to be in error, corrected. If there are accounts or charges you did not authorize, immediately notify the appropriate consumer reporting agency by telephone and in writing. Consumer reporting agency staff will review your report with you. If the information cannot be explained, then you will need to call the creditors involved. Information that cannot be explained also should be reported to your local police or sheriff’s office because it may signal criminal activity.

Report Incidents. If you detect any unauthorized transactions in a financial account, promptly notify your financial institution or card issuer. If you detect any incident of identity theft or fraud, promptly report the incident to law enforcement and your state Attorney General. If you believe your identity has been stolen, the FTC recommends that you take these steps:

Close the accounts that you have confirmed or believe have been tampered with or opened fraudulently. Use the resources available at https://www.identitytheft.gov/ to report unauthorized accounts.

File a local police report. Obtain a copy of the police report and submit it to your creditors and any others that may require proof of the identity theft crime.

You can contact the FTC to learn more about how to protect yourself from becoming a victim of identity theft and how to repair identity theft:

Federal Trade Commission

Consumer Response Center

600 Pennsylvania Avenue, NW

Washington, DC 20580

1-877-IDTHEFT (438-4338)

https://www.consumer.ftc.gov/features/feature-0014-identity-theft

Consider Placing a Fraud Alert or Security Freeze on Your Credit File. To protect yourself from possible identity theft, consider placing a fraud alert or security freeze (also known as a “credit freeze”) on your credit file. A fraud alert helps protect you against the possibility of an identity thief opening new credit accounts in your name. When a merchant checks the credit history of someone applying for credit, the merchant gets a notice that the applicant may be the victim of identity theft. The alert notifies the merchant to take steps to verify the identity of the applicant. A security freeze is designed to prevent potential creditors from accessing your credit file at the consumer reporting agencies without your consent. Unlike a fraud alert, you must place a security freeze on your credit file at each consumer reporting agency individually. For more information on fraud alerts and security freezes, you may call any one of the toll-free numbers provided below or contact the FTC as described above.

Equifax Equifax Credit Information Services, Inc.

P.O. Box 740241

Atlanta, GA 30374 1-800-525-6285 www.equifax.com Experian Experian Inc.

P.O. Box 9554

Allen, TX 75013 1-888-397-3742 www.experian.com TransUnion TransUnion LLC

P.O. Box 2000

Chester, PA 19022-2000 1-800-680-7289 www.transunion.com

For New York Residents. You can obtain information from the New York State Office of the Attorney General about how to protect yourself from identity theft and tips on how to protect your privacy online. You can contact the New York State Office of the Attorney General at:

Office of the Attorney General

The Capitol

Albany, NY 12224-0341

1-800-771-7755 (toll-free)

1-800-788-9898 (TDD/TTY toll-free line)

https://ag.ny.gov

Bureau of Internet and Technology (BIT)

28 Liberty Street

New York, NY 10005

Phone: (212) 416-8433

https://ag.ny.gov/internet/resource-center

List of Restaurants Affected by the Additional Activity and Estimated Windows of Exposure

Posted: November 15, 2019

California

Rally’s 4273

1406 W. 6th St.

Corona, CA 92882

Exposure Dates: 03/29/18 – 04/01/19; 06/30/19 – 09/20/19 Rally’s 4088

105 N. Beach Blvd.

Anaheim, CA 92801

Exposure Dates: 10/09/18 – 04/08/19; 05/01/19 – 09/20/19

Delaware

Checkers 3585

1901 W. 4th St.

Wilmington, DE 19805

Exposure Dates: 10/13/18 – 04/07/19; 05/10/19 – 09/20/19

Florida

Checkers 5106

1615 E. Hillsborough Ave.

Tampa, FL 33610

Exposure Dates: 10/12/18 – 04/05/19; 05/30/19 – 10/09/19 Checkers 6295

3200 N. Pace Blvd.

Pensacola, FL 32505

Exposure Dates: 10/14/18 – 04/07/19; 09/05/19 – 09/05/19 Checkers 6298

5300 N. Davis Hwy.

Pensacola, FL 32503

Exposure Dates: 07/24/19 – 09/24/19

Georgia

Checkers 3184

3474 Victory Dr.

Columbus, GA 31903

Exposure Dates: 03/26/18 – 04/05/19; 08/01/19 – 09/20/19 Checkers 3549

6435 Bells Ferry Rd.

Woodstock, GA 30189

Exposure Dates: 10/10/18 – 04/07/19; 07/25/19 – 09/20/19 Checkers 3079

4948 Jonesboro Rd.

Forest Park, GA 30298

Exposure Dates: 10/11/18 – 04/05/19; 08/01/19 – 09/20/19 Checkers 3080

2854 Candler Rd.

Decatur, GA 30034

Exposure Dates: 10/11/18 – 04/11/19; 07/31/19 – 09/20/19 Checkers 3548

1400 Hudson Bridge Rd.

Stockbridge, GA 30281

Exposure Dates: 10/12/18 – 04/07/19; 05/10/19 – 09/20/19 Checkers 3061

9500 Hwy. 92

Woodstock, GA 30188

Exposure Dates: 10/14/18 – 04/05/19; 05/01/19 – 09/20/19

Illinois

Checkers 3583

17701 S. Torrence Ave.

Lansing, IL 60438

Exposure Dates: 09/29/18 – 04/01/19; 08/01/19 – 09/20/19

Kentucky

Rally’s 4159

1790 Airport Exchange

Erlanger, KY 41018

Exposure Dates: 10/13/18 – 04/08/19; 07/01/19 – 09/20/19

Louisiana

Checkers 3240

1708 S. 5th St.

Leesville, LA 71446

Exposure Dates: 10/10/18 – 03/31/19; 05/01/19 – 09/20/19

Michigan

Rally’s 4201

2961 Cook Road

West Branch, MI 48661

Exposure Dates: 08/10/18 – 04/08/19; 05/30/19 – 10/06/19

New Jersey

Checkers 3114

2881 Mount Ephraim Ave.

Camden, NJ 08104

Exposure Dates: 10/27/18 – 04/05/19; 07/26/19 – 09/20/19

New York

Checkers 3023

136 Sunrise Hwy.

Lindenhurst, NY 11757

Exposure Dates: 10/11/18 – 04/05/19; 08/01/19 – 09/20/19 Checkers 3024

1825 Brentwood Rd.

Brentwood, NY 11717

Exposure Dates: 10/11/18 – 04/05/19; 08/03/19 – 09/20/19 Checkers 3028

258 Portion Rd.

Lake Ronkonkoma, NY 11779

Exposure Dates: 10/11/18 – 04/05/19; 07/31/19 – 09/20/19 Checkers 3457

225 1st Ave.

New York, NY 10003

Exposure Dates: 10/14/18 – 04/30/19; 08/04/19 – 09/20/19

Ohio

Rally’s 9056

2115 N. Verity Pkwy.

Middletown, OH 45042

Exposure Dates: 10/12/18 – 04/10/19; 07/01/19 – 09/22/19 Rally’s 9019

1796 S. Erie Blvd.

Hamilton, OH 45011

Exposure Dates: 10/13/18 – 04/08/19; Unknown – 10/12/19 Rally’s 9136

4115 Glenway Ave. #1

Cincinnati, OH 45205

Exposure Dates: 10/13/18 – 04/07/19; 05/10/19 – 09/22/19

Pennsylvania

Checkers 5334

7115 Stenton Ave.

Philadelphia, PA 19138

Exposure Dates: 10/12/18 – 04/06/19; 07/30/19 – 09/20/19 Checkers 5644

3709-25 N. Broad St.

Philadelphia, PA 19140

Exposure Dates: 10/13/18 – 04/05/19; 08/02/19 – 09/20/19

Virginia

Checkers 3481

826 Berryville Ave.

Winchester, VA 22602

Exposure Dates: 03/25/18 – 04/18/19; 08/03/19 – 09/20/19

* To view Checkers and Rally’s May 29, 2019 announcement, please click here.

FAQs

Posted: November 15, 2019

What happened? On May 29, 2019, we notified our guests about the installation of malware on certain point-of-sale systems at some Checkers and Rally’s locations. We recently became aware of suspected payment card compromise at one additional Checkers and Rally’s location that previously had not been affected by the malware issue. After conducting an investigation with the assistance of leading data security experts, we confirmed that this restaurant was subsequently affected by the same malware issue we reported in May, which enabled an unauthorized party to obtain the payment card data of some guests at this location. We also determined that the unauthorized party re-installed the malware at several of the restaurants we previously identified as being impacted. Our investigation has found that this additional activity is connected to the same actor responsible for the issue we disclosed on May 29, 2019. A list of the locations affected by this additional activity and their respective estimated dates of exposure is available here. We have taken steps to contain and remove the malware, and are coordinating closely with federal law enforcement authorities in their investigation of this matter. Is this November 2019 notification related to the issue announced on May 29, 2019? Yes. Our investigation has found that this additional activity is connected to the same actor responsible for the issue we disclosed on May 29, 2019. What information was affected by this issue? The malware was designed to collect information stored on the magnetic stripe of payment cards, including cardholder name, payment card number, card verification code and expiration date. Based on the investigation, we have no evidence that other cardholder personal information was affected by this issue. Was my payment card data affected by this additional activity? Not all Checkers and Rally’s restaurants were affected by this additional activity. A list of the impacted locations and their respective estimated dates of exposure is available here. In addition, not all guests who visited the listed restaurants during the relevant time periods are affected by this issue. While we do not know if your specific payment card is affected by this issue, we encourage potentially impacted guests to refer to their payment card statements to identify the payment card they may have used at one of the affected Checkers and Rally’s locations. If you believe there is an unauthorized charge on your card, please contact your financial institution or card issuer immediately. It is always a good idea to be checking your statements regularly. Is it safe to use a payment card at our restaurants? We have worked closely with leading security experts to contain and remove the malware from the impacted locations. We take the protection of our guests’ information very seriously and continue to take steps to enhance the security of our systems. Will I be liable for fraudulent charges that may result from this matter? We encourage you to review your account statements and contact your financial institution or card issuer immediately if you identify an unauthorized charge on your card. The payment card brands’ policies provide that cardholders have zero liability for unauthorized charges that are reported in a timely manner. Please contact your card brand or issuing bank for more information about the policy that applies to you. What are you doing to address this issue? Upon being alerted of the additional malware activity, we quickly engaged a leading data security firm to launch an extensive investigation and assist us with containing and removing the malware. We are working closely with federal law enforcement authorities and affected restaurants to address the matter. We also are coordinating with the payment card companies in their efforts to protect cardholders. We continue to take steps to enhance the security of our systems and prevent this type of issue from happening again. What should I do to help protect my information? You are entitled under U.S. law to one free credit report annually from each of the three nationwide consumer reporting agencies. To order your free credit report, visit www.annualcreditreport.com or call toll-free at 1-877-322-8228. For more information about steps you can take to protect your credit files, you can contact any one of the consumer reporting agencies at: Equifax Equifax Credit Information Services, Inc.

P.O. Box 740241

Atlanta, GA 30374 1-800-525-6285 www.equifax.com Experian Experian Inc.

P.O. Box 9554

Allen, TX 75013 1-888-397-3742 www.experian.com TransUnion TransUnion LLC

P.O. Box 2000

Chester, PA 19022-2000 1-800-680-7289 www.transunion.com We encourage you to review your account statements and free credit report, and contact your financial institution or card issuer immediately if you identify an unauthorized charge on your card. Where can I get more information? If you have any questions about this issue, please call 1-833-281-4832, Monday through Friday from 8:00 a.m. to 10:00 p.m. CST and Saturday and Sunday from 10:00 a.m. to 7:00 p.m. CST.

Press Release

Posted: November 15, 2019

Checkers Drive-In Restaurants, Inc. Provides Update on Data Security Issue

Tampa, Florida (November 15, 2019) – Checkers Drive-In Restaurants, Inc. (“Checkers”) announced today that it is providing an update on the malware issue it disclosed on May 29, 2019, that affected certain Checkers and Rally’s locations. In October 2019, the company became aware that one additional Checkers and Rally’s restaurant was subsequently affected by the same malware issue. After conducting a further investigation with leading data security experts, Checkers also determined that the malware had been re-installed at several of the locations the company previously identified as being affected by this issue. The company has taken steps to contain and remove the malware, and is coordinating closely with federal law enforcement authorities in their investigation of the matter.

Based on the company’s investigation, Checkers determined the following:

This additional activity is connected to the same actor responsible for the issue disclosed on May 29, 2019.

The malware was designed to collect information stored on the magnetic stripe of payment cards, including cardholder name, payment card number, card verification code and expiration date. Checkers has no evidence that other cardholder personal information was affected by this issue.

Not all Checkers and Rally’s restaurants and not all guests who visited the impacted restaurants during the relevant time periods were affected by this issue.

A list of the locations affected by this additional activity and their respective estimated dates of exposure is available at www.checkers.com/security-issue.

Checkers encourages guests to review their account statements and contact their financial institution or card issuer immediately if they identify an unauthorized charge on their card.

Guests with any questions about this issue may call 1-833-281-4832, Monday through Friday from 8:00 a.m. to 10:00 p.m. CST and Saturday and Sunday from 10:00 a.m. to 7:00 p.m. CST. Information about this issue is available on the company’s website at www.checkers.com/security-issue.

About Checkers Drive-In Restaurants, Inc.

Based in Tampa, Fla., Checkers Drive-In Restaurants, Inc. operates and franchises both Checkers® and Rally’s® restaurants, with nearly 900 restaurants across the country. For more information about the company, please visit https://www.checkers.com.

Media Contact:

Kim Francis

Magpie, LLC

813.528.2252

Kim@MagpieLLC.com