Michaels Stores Inc, the biggest U.S. arts and crafts retailer, on Friday confirmed that there was a breach of certain systems that process payment cards at its U.S. stores and that of its unit, Aaron Brothers.
Some 3 million cards were affected in the breach, including as many as 2.6 million at Michaels locations and another 400,000 at Aaron Brothers stores. The company says it has received "limited" reports of fraud.
The attacks, which were first made known in January, when the company announced it was working with federal law enforcement officials to investigate a possible data breach, started as early as May 8, 2013, and concluded by Feb. 27, 2014.
While the affected systems contained certain payment card information, there was no evidence that those data were at risk, the company said in a statement on Friday.
Michaels said it continues to work with law enforcement authorities, banks and payment processors, and noted that the malware no longer presents a threat.
The company, which owns several private brands such as Recollections, Artist's Loft and Loops & Threads, competes with Hobby Lobby Stores Inc, Jo-Ann Stores Inc and Wal-Mart Stores Inc.
—By Reuters, with CNBC staff contributing