A series of attacks on US retailers could be larger than thought, with several victims yet to come forward.