Michaels, the biggest arts and crafts retailer in the U.S. confirms it has been the target of a security breach.

Michaels stores say nearly 2.6 million credit and debit cards may have been affected.

The breach occurred between May 8, 2013 and Jan. 27 of this year.

In a statement, Michaels said:

After weeks of analysis, we discovered evidence confirming that systems of Michaels stores in the United States and our subsidiary, Aaron Brothers, were attacked by criminals using highly sophisticated malware that had not been encountered previously by either of the security firms.

 

The company is encouraging customers to order a free credit report, report incidents, use identity protection and credit monitoring services, and to consider placing a fraud alert or security freeze on your credit file.