Michaels, the crafts chain, confirmed Thursday a security breach that lasted eight months, affecting nearly three million customers. The confirmation comes three months after the store said it had learned of a possible breach. The nation's largest crafts store has been investigating the breach. Micheals said nearly three million customers' information had been stolen from their point-of-sale systems. The breach occurred between May 8, 2013 and Jan. 27, 2014 and affected around 7 percent of transactions made with cards during that period. The company said that not all stores were affected and only a limited number of cards have been used fraudulently since then. Aaron Brothers, a subsidiary of Michaels, was also affected by the breach between June 2013 and February 2014. The stolen information includes credit and debit card numbers and expiration dates. Customer names, addresses and Personal Identification Numbers were not stolen. "The affected U.S. systems contained certain payment card information, such as payment card number and expiration date, about both Michaels and Aaron Brothers customers," a statement from the company read.