The news comes three months after the largest US crafts chain told customers it learned of a possible hack. The company has been investigating since then.
Some credit and debit card numbers and expiration dates were compromised. But the company said there is no evidence that information such as customer names or pins were stolen.
The breach affected about seven percent of card transactions at its stores from early may to late January.
The Michaels subsidiary Aaron Brothers was also hacked.
Information from another 400,000 cards was potentially stolen at the Aaron Brothers stores between late June and late February.
The initial Michaels announcement came just weeks after Target also disclosed it was hacked.
Click here for the list of stores affected by the breach.