Four Michaels stores in the Dayton and northern Cincinnati area are involved in the company’s massive credit-card data breach, officials with the arts and crafts chain said Friday.
An estimated 2.6 million cards, or about 7 percent of all debit and credit cards used at its namesake stores, may have been affected by the security breach, Michaels officials said.
The malware that led to the breach has since been removed and attacked a limited number of checkouts at some stores between May 8, 2013, and Jan. 27, 2014, company officials said. Company officials said they are offering affected Michaels and Aaron Brothers customers in the U.S. identity protection, credit monitoring and fraud assistance services for 12 months at no cost.
Affected stores and their dates of exposure include these Michaels stores:
• 2500 N. Fairfield Road in Beavercreek, with a period of exposure from May 8, 2013 to July 29, 2013;
• 8111 Springboro Pike in Miami Twp., with exposure dates ranging from May 8, 2013 to Jan. 19, 2014, with some brief breaks in exposure in between those dates;
• 3455 Princeton Road in the Bridgewater Falls retail center in Fairfield Twp., with exposure dates ranging from May 8, 2013 to Jan. 18, 2014;
• 7624 Voice of America Centre Drive in West Chester, with exposure dates ranging from May 8, 2013 to Jan. 19, 2014.
For more information on the data breach and exposure dates, a list of the stores affected, and how the company is responding, go to www.michaels.com or call (877) 412-7145
Irving, Texas-based Michaels said that it has contained the incident, but said it has received limited reports of fraud from banks and the payment card brands that potentially are connected to the breach.
The compromised data includes customer information such as payment card numbers and expiration dates. But there’s no evidence that other personal information such as names, addresses or PIN numbers were at risk, Michaels officials said.
Michaels first said in late January that it may have been hacked. It’s been working with federal law enforcement and two private-security firms since then.
The Associated Press contributed to this report.