(IRVING, Texas) -- Three months after learning of a possible security breach, Michaels announced on Thursday that it has discovered evidence confirming it was indeed attacked.
The arts and crafts chain said in a statement "that systems of Michaels stores in the United States and its subsidiary, Aaron Brothers, were attacked by criminals using highly sophisticated malware that had not been encountered previously by either of the security firms" running the investigation.
Approximately 2.6 million cards used in Michaels stores between May 8, 2013 and Jan. 27, 2014, and 400,000 cards used between June 26, 2013 and Feb. 27, 2014 at 54 Aaron Brothers stores may have been affected.
"The affected systems contained certain payment card information, such as payment card number and expiration date, about both Michaels and Aaron Brothers customers. There is no evidence that other customer personal information, such as name, address or PIN, was at risk in connection with this issue," Michaels said in the statement.
So far, the retailer has received "limited" reports of fraudulent card use.
Michaels says the incident is now fully contained and the malware no longer presents a threat to shoppers at either store.
Copyright 2014 ABC News Radio