PORTLAND, Ore. - Staples Inc. said nearly 1.2 million customer payment cards may have been exposed during a security breach earlier this year.

The office supply retailer announced in October that it was looking into a potential credit card breach, adding to a long list of retailers recently hit by cyberattacks.

Staples said Friday an investigation shows the criminals used malware that may have allowed access to information for transactions at 115 of its U.S. stores, which total more than 1,400 transactions. That includes cardholder names, payment card numbers, expiration dates and card verification codes.

The Framingham, Mass.-based company is offering free identity protection services - including credit monitoring, identity theft insurance a free credit report - to customers who might be at risk.

The security breach affected different stores at different times between July and September.

Staples said it has also received reports of fraudulent card use tied to four of its New York stores between April and September. While it found no evidence of malware at those stores, it is also offering the protection services to customers there as well.

A number of retailers have suffered security breaches in recent memory.

During last year's holiday shopping season, Target Corp. disclosed it was hit with an attack that exposed details of as many as 40 million credit and debit card accounts. Home Depot announced in September that a data breach affected 56 million debit and credit cards, and later said hackers also stole 53 million email addresses. And the cyberattack on Sony Pictures Entertainment that came into the spotlight this week has put a number of companies on high alert to tend to the security of their own networks.