Approximately 2.6 million payment cards used at Michaels locations were accessed, along with 400,000 cards used at Aaron Brothers.