Michaels Stores said that its debit card terminals were compromised in 20 states, yet fewer than 100 customer debit cards were reported as used in fraudulent transactions.
It said that customers who made PIN-based debit card purchases at Michaels from Feb. 8 through May 6 might have been victims.
The company is in the process of replacing store PIN pads with the "most current, tamperproof equipment available today," starting with those in the Chicago region, which was hit the hardest.
Michaels said it did not have details on how exactly the tampering occurred in the stores. "We have quarantined the devices and have turned several over to the Secret Service so they can examine them," said Doug Marker, vice president of loss prevention and safety for Michaels. "[We] have a forensics team examining the other affected devices as well."