The Wilderness Waterpark Resort in the Wisconsin Dells was affected.
The numbers for up to 40,000 credit and debit cards may have been compromised.
Anyone who used the arcade between December 12, 2008 and May 25, 2011 may need to check for unauthorized activity.
Visitors to the Smokies Resort in Tennessee may also have been hacked.
The company says it shut down its card processing systems at both arcades when it found out about the breach.
