Michaels Stores Inc.

A number of PIN pads in Chicago-area Michaels stores were found to have been tampered with.  Michaels checked 7,200 PIN pads in 964 US stores.  Fewer than 90 pads were found to have been compromised, but the affected pads were in 20 states. Michaels expects the process of replacing the pads to last about 15 days. The number of affected customers is in the tens of thousands. PIN pads in Canada will also be checked.The Chicago-area was the hardest hit; 14 stores had compromised PIN pads. Customers who used their debit or credit cards at Michaels are encouraged to monitor their transaction records. Michaels Stores released an official statement.UPDATE (05/19/2011): A suit seeks class-action status and more than $5 million in damages for people whose credit and debit accounts were compromised by the breach.  The lawsuit claims that Michaels failed to protect customers from "cyber-pickpockets" who stole sensitive banking information from checkout keypads at stores in 20 states. Michaels is accused of knowingly violating federal and state law by failing to take reasonable steps to safeguard customers' personal information.  Michaels is also accused of failing to alert customers as soon as the security breach was discovered. There is now a theory that thieves used a combination of  "false card readers", wireless cameras or electronic membranes placed over keypads to collect the PINs and card information of MIchaels' customers. This allowed them to create fraudulent debit and credit cards.UPDATE (05/31/2011): A second lawsuit was filed in late May.  The new suit also seeks class-action status.  It alleges that Michaels failed to safeguard shoppers' credit and debit PINs and other information.  The second lawsuit was filed by an Illinois resident who saw over $1,000 in fraudulent charges after making an $18.16 purchase at Michaels.UPDATE (06/20/2011): An extensive fraud case has hit multiple areas of Oregon.  Over 250 people have reported fraudulent charges related to cards that were used at Michaels stores.UPDATE (06/27/2011): Four suspects were caught making fraudulent debit card transactions on camera.  The images have been distributed by investigators hoping that someone in the Beaverton, Oregon area will recognize one or more of the people.  Additionally, Michaels now faces a total of four lawsuits related to the data breach.UPDATE (07/13/2011): A number of Iowa residents began reporting debit card fraud that could potentially be related to the Michaels breach.UPDATE (03/21/2012): Two men will be sentenced for their roles in setting up phony debit and credit card pads in the 84 Michaels stores.  Each pleaded guilty to one count of conspiracy to commit bank fraud, one count of bank fraud, and one count of aggravated identity theft. A total of 94,000 credit and debit card account numbers were stolen.UPDATE (07/30/2012): The two men were each sentenced to 36 months in prison for conspiracy to commit bank fraud.  An additional 24 months were added for aggravated identity theft.  The must also pay $42,000 in restitution and will have five years of supervised release.