The company said on Saturday that it started the investigation after learning of possible fraudulent activity on some U.S payment cards which had been used at Michaels' stores.
Michaels Stores said it is working with federal law enforcement and hired third party forensic investigators to determine if there had been any data breach.
While the company said it has not yet confirmed a data breach, the company has decided it is better to notify its customers so that they can protect themselves.
This is third biggest credit card cyber attack reported in recent months. In December 2013, US retail giant Target reported a data breach affecting 40 million customers. Earlier this month, US luxury retailer Neiman Marcus also notified about a data breach that exposed approximately 1.1 million credit and debit cards to hackers.
