Michaels says a security breach at its stores lasted eight months and affected about three million customers.
The news comes three months after the largest US crafts chain told customers it learned of a possible hack.
It's been investigating since then.
Some credit and debit card numbers and expiration dates were compromised.
But the company said there is no evidence that information such as customer names or pins were stolen.
The breach affected about seven percent of card transactions at its stores from early May to late January.
The Michaels subsidiary Aaron Brothers was also hacked.
Information from another 400,000 cards was potentially stolen at the Aaron Brothers stores between late June and late February.
The initial Michaels announcement came just weeks after Target also disclosed it was hacked.