Credit Card Breach Hits 2.6M Michaels Customers

Michaels Stores Inc. said yesterday that about 2.6 million cards, or about 7% of all debit and credit cards used at its namesake stores, may have been affected in a security breach. The nation's largest arts and crafts chain said its subsidiary Aaron Brothers was also attacked, with about 400,000 cards potentially affected. Irving, Texas-based Michaels said that it has contained the incident, which occurred between May 8, 2013, and Jan. 27 (or, for Aaron Brothers customers, between June 26, 2013, and Feb. 27).

The compromised data includes customer information such as payment card numbers and expiration dates. But there's no evidence that other personal information such as names, addresses, or PIN numbers were at risk, Michaels said. The company says both chains were attacked by criminals using highly sophisticated malware that had not been encountered previously by the two security firms that were conducting the investigation. Michaels is offering free identity protection, credit monitoring, and fraud assistance services to affected customers in the US for 12 months. (More security breach stories.)