According to a report in Bloomberg, the data breach affected 0.5 per cent of customers registered on Macys.com and Bloomingdales.com.
The company detected the suspicious activity on June 11 and blocked the profiles in question on June 12.
Other personal data may have been accessed, through the company confirmed social security numbers were not.
The company operates approximately 690 department stores under the Macy’s and Bloomingdale’s brands,.
Macy’s Inc. have been contacted for comment.