The Iowa Attorney General's Office disclosed a data breach affecting FOCUS Brands Inc., specifically its subsidiaries McAlister's Corporation, Moe's Stores LLC, and Schlotzsky's Stores LLC. The incident involved unauthorized malicious code deployed on point-of-sale (POS) systems at both corporate and franchised restaurant locations. The breach occurred between April 11, 2019, and July 22, 2019, during which payment card data—including card numbers, expiration dates, and potentially CVV codes—was compromised. While the exact number of affected individuals remains unknown, the exposure targeted customers who dined at the impacted restaurants during the specified period. The breach did not involve internal employee data or broader corporate systems but focused solely on financial transaction data linked to customer payments. The company took remedial actions, including removing the malicious code and enhancing security protocols, though the delay in detection (nearly three months) raised concerns about vulnerability management. No evidence suggested the stolen data was used for fraud at the time of reporting, but the potential for financial fraud and reputational harm persisted due to the nature of the compromised information.