Michaels Stores, whose major investors are Blackstone Group LP and Bain Capital LP, said cyber security firms it hired found that malware not encountered previously had been used in the latest attack.
The company said it was working with law enforcement authorities, banks and payment processors, and that the malware no longer presents a threat.
Michaels Stores, which resubmitted its IPO documents late last month following a restructuring, is the latest U.S. retailer whose systems have been breached.
Last year, the number three U.S. retailer Target Corp suffered a massive security breach that resulted in the theft of some 70 million customer records.