Four Jimmy John’s stores in Iowa were impacted by a recent security breach. According to a news release from the Illinois-based restaurant chain, customers’ credit card data was stolen from 216 Jimmy John’s stores in 37 states between June and early September.

That includes four sandwich shops in Iowa located at 2801 Grand Avenue North in Ames, 2016 College Street in Cedar Falls, 202 South Ankeny Boulevard in Ankeny, and 4926 Southeast 14th Street in Des Moines.

Investigators believe someone stole log-in credentials and remotely installed malware on machines used to swipe credit cards. The new release states Jimmy John’s has taken steps to restore its security.