Millions of customer credit and debit card numbers were stolen from TJ Maxx and Marshall's.
The company that owns the clothing chains said nearly 46 million numbers were stolen over the last year and a half.
The announcement comes more than two months after first disclosing that criminals hacked into customers' financial data from its computers.
A company spokesman says 75% of the cards stolen were either expired, or had their data masked.
TJX is being sued by affected cardholders in the US, Canada and Puerto Rico.
The company says they will continue to investigate the security breach.
