As we learned last week based on information from people in the banking industry, payment cards used at Sonic Drive-In locations have been linked to suspicious transactions. Sonic confirmed today that its payment systems were indeed breached in a malware attack, potentially by crooks seeking payment card numbers.

What Sonic isn’t doing is specifying the locations where this happened. In a chain with thousands of restaurants, that information would be helpful.

Instead, the milkshake-centric drive-in chain has simply confirmed that there was a malware breach and that credit and debit cards may have been taken. There were five million payment card numbers in the batch potentially linked to Sonic, but those numbers may have come from different sources.

The breach happened at “certain Sonic Drive-In locations,” Sonic said in a statement, and it is offering any customer who used a credit or debit card at any of its restaurants in 2017 two years of free credit monitoring from Experian.

This is the standard gesture that companies make after a credit card breach. Even credit bureau Equifax offered its own credit monitoring to victims of its own massive breach of personal data on most American adults.

Read more: Don’t Take Equifax Up On Its Credit Monitoring Offer

However, by the time a credit monitoring service lets you know that there’s a new account opened in your name, it’s already happened. If you are concerned about someone opening accounts in your name, be sure to check your credit report from the annualcreditreport.com site, which lets you check each bureau’s report once per year.

And, just like the free TrustedID service that Equifax offered in the wake of its recent data breach, the Experian monitoring service includes a forced arbitration clause in its Terms of Service, meaning you wouldn’t be able to sue Experian if you had a legal dispute regarding this service.

If you’re really concerned about someone opening accounts in your name, contact each credit bureau to place a freeze on your file, which keeps anyone from opening any accounts unless you contact the bureau to un-freeze it.

To take Sonic up on its monitoring offer, if that still interests you, go to www.experianidworks.com/sonic.

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.