Michaels confirms breach of up to 2.6M cards

Associated Press

NEW YORK

Michaels Stores Inc. said Thursday that about 2.6 million cards, or about 7 percent of all debit and credit cards used at its namesake stores, may have been affected in a security breach.

The nation’s largest arts- and-crafts chain said its subsidiary Aaron Brothers also was attacked, with about 400,000 cards potentially affected.

Irving, Texas-based Michaels said that it has contained the incident, which began last year. It has received “limited” reports of fraud from banks and the payment-card brands that potentially are connected to the breach.

The compromised data include customer information such as payment- card numbers and expiration dates. But there’s no evidence that other personal information such as names, addresses or PINs were at risk, Michaels said.

Michaels’ report comes as many shoppers worry about the safety of their personal data after a massive pre-Christmas security breach at Target Corp. that affected 40 million debit and credit cards.

The details come nearly three months after Michaels disclosed that it may have been a victim of a data breach and that it was working with law- enforcement authorities, banks and payment processors.

The company said Thursday that both chains were attacked by criminals using highly sophisticated malware that had not been encountered previously by the two security firms that were conducting the investigation.