Michaels, the craft store chain that confirmed a data breach earlier this year, said nearly 3 million customers’ information had been stolen from its point-of-sale system, including from several Washington-area stores.
The company’s statement late Thursday said two security firms had found that criminals broke into Michaels’s system using “highly sophisticated malware that had not been encountered previously by either of the security firms.”
The malware has since been removed, the company said.
Michaels posted a list of all affected stores on its Web site. The list includes 23 stores in Maryland and eight stores in Northern Virginia. The retailer does not have any locations in the District. A total of 2.6 million cards — or 7 percent of cards used at Michaels stores during the breach period — were affected. An additional 400,000 cards at its subsidiary Aaron Brothers were affected, the retailer said.
By Susie Madrak
— April 18, 2014
