It says there could be fraudulent charges to customers’ accounts because of the breach, but adds that those customers won’t be liable to pay them.
WATCH: Metro AG sells German department store chain to Hudson’s Bay in $3.9 billion acquisition
HBC is asking clients to review their account statements to ensure there hasn’t been activity or transactions they don’t recognize.
The company says it’s investigating and taking steps to contain the attack.
It says it will offer free identity protection services to those affected once they learn more about the breach.
New York-based security firm Gemini Advisory LLC says a hacking group called JokerStash announced last week that it had put more than 5 million stolen credit and debit cards up for sale, and that the compromised records came from Saks and Lord & Taylor customers.