This means that customer data likely includes full names, phone numbers, postal addresses and e-mail addresses. The spokeswoman didn't say what information was required for age confirmation, so it's not clear if customers simply checked a box saying they were adults or if they had to provide their date of birth.

"In the event that you are contacted by someone claiming to be from McDonald's asking for personal or financial information, do not respond and instead immediately contact us," reads the McDonald's note to customers. The number to call is 1-800-244-6227.

In addition to working with law enforcement agencies, McDonald's is probing the security breakdown at the company hired by , which is the marketing services division of ad agency Leo Burnett. Arc's specialities include digital communications, direct marketing, promotions and shopper marketing, according to its website.

The spokeswoman didn't say how many people are potentially affected and in what countries, besides the U.S. She also didn't say when the breach happened.