It was unclear if the possible security breach affected Staples stores in Canada, where officials referred inquiries to the company's headquarters in Framingham, Mass.
The office supplies retailer said Tuesday that if it turns up any data discrepancies during its investigation, customers won't be responsible for fraudulent activity on their credit cards as long as it is reported in a timely manner.
"We take the protection of customer information very seriously and are working to resolve the situation," spokesman Mark Cautela said in a statement.
Earlier this month Sears Holdings Corp. reported a breach at its Kmart stores that started last month, saying some customers' credit and debit cards may have been compromised. Other breaches have occurred at retailers including Target Corp., Supervalu Inc. and Home Depot Inc..
Shares of Staples Inc. slipped three cents to US$12.27 in midday trading. Its shares have fallen 23 per cent over the past year.
— With files from The Canadian Press