The news comes three months after the largest U.S. crafts chain told customers it learned of a possible hack. It's been investigating since then.
Some credit and debit card numbers and expiration dates were compromised. The company said there is no evidence that information such as customer names or PINs were stolen.
The breach affected about 7% of card transactions at its stores from early May to late January.
Copyright 2016 Nexstar Broadcasting, Inc. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.