Staples reported that malware that infected its registers in 115 stores had access to bank card numbers from 1.16 MILLION customers.
The chain today confirmed that hundreds of thousands of customers are at risk of fraud after spyware compromised their POS stations between August 10 and September 16 of this year.
Staples had given word of the attack in October, stating the breach was limited to a small number of its 1,400 outlets in the US.
The Staples at 350 Bedford Road in Mt. Kisco is on the list of stores [PDF] that includes 11 in the NY Metro area.
"Typically, customers are not responsible for any fraudulent charges on their credit cards that are reported in a timely fashion," Staples said a statement.
"Staples customers who shopped at the affected stores during the relevant time periods should review their account statements and notify their card issuers of any suspicious activity."