Thousands of credit card numbers are for sale online after hackers targeted the chain restaurant P.F. Chang's, reports cybersecurity journalist Brian Krebs.

It's unknown how widespread the breach is, but banks told Krebs that the card information appeared to have been stolen from locations in at least six states as well as Puerto Rico, Mexico, Canada, Argentina, Chile, and the Middle East. The card numbers, which are being sold for between $18 and $140, were used between March and May.

Credit card numbers were in at least six states and abroad

The chain has 211 P.F. Chang's locations in the US and 192 Pei Wei Asian Diner restaurants. If the breach affects all stores, Krebs estimates "we're looking at 1 million to 2 million cards stolen at least." P.F. Chang's says it is investigating the breach.

The hack follows similar breaches at Sally's Beauty Supply, Nieman Marcus, and Michael's, in which hackers installed malware at the point of sale. Target was the victim of the largest such attack in recent memory, with around 40 million cards stolen over the Thanksgiving holiday. That theft cost banks and credit card unions upward of $200 million.