Breach affects up to 3 million cards at Michaels, subsidiary

More than two months after it said a data breach may have led to fraudulent activity on payment cards used at stores, Michaels announced about 3 million cards may have been affected.

In a statement, the Irving, Texas-based arts and crafts chain said two security firms hired to investigate the data breach never encountered the “highly sophisticated malware” used by hackers to access point-of-sale systems at Michaels and subsidiary Aaron Brothers containing payment card numbers and expiration dates.

ALSO READ: Michaels joins recent data breach rash

The malware affected Michaels’ systems from the start of May 2013 until the end of January 2014. Aaron Brothers was affected from the end of June 2013 until the end of February this year. The months-long analysis has concluded about 2.6 customer payment cards could have been affected at Michaels. Another 400,000 may have been accessed at Aaron Brothers.

“In an era where very sophisticated and determined criminals have proven capable of successfully attacking a wide range of computer networks, we must all increase our level of vigilance,” said CEO Chuck Rubin. “Michaels is committed to working with all appropriate parties to improve the security of payment card transactions for all consumers.”

The retailer said the malware is no longer a threat. There is no evidence other personally identifiable information, such as names, address or card PINs, were stolen.

“The company has received a limited number of reports from the payment card brands and banks of fraudulent use of payment cards potentially connected to Michaels or Aaron Brothers,” said Michaels, adding it is offering one year of identity-theft protection, credit monitoring and fraud assistance to affected customers.

Locations affected by the breach are listed on the stores’ websites.