Malware on a payment system could have stolen credit card info from customers in 28 states, according to the company. Read more