A security breach at Target stores around the country might leave millions of Americans at the mercy of credit card fraud.

The Secret Service is currently investigating credit card information being stolen from Target customers around the country. And it might take months for shoppers to learn if they’re victims. Krebs on Security, a blog that first broke the story, said that the breach involved almost every Target outlet in the United States and extended from around Thanksgiving/Black Friday until Dec. 15.

Krebs said the breach involved data stored on the magnetic strip of cards used only in its brick and mortar stores and not online. Target has 1,797 stores in the U.S. They have 24 stores in Canada.

Target’s corporate website posted a letter warning its customers about the breach and presenting recommendations on how to handle the latest developments.

“We began investigating the incident as soon as we learned of it,” read the statement. “We have determined that the information involved in this incident included customer name, credit or debit card number, and the card’s expiration date and CVV (the three-digit security code).”

Target’s corporate statement also announced its work with other entities to ensure the best response to the breach for its customers.

“We are partnering with a leading third-party forensics firm to conduct a thorough investigation of the incident and to examine additional measures we can take that would be designed to help prevent incidents of this kind in the future,” read the statement. “Additionally, Target alerted authorities and financial institutions immediately after we discovered and confirmed the unauthorized access, and we are putting our full resources behind these efforts.”

The retailer also recommended that everyone remain vigilant for incidents of fraud and identity theft and review account statements on a regular basis. They also recommend that customers monitor free credit reports.

“If you discover any suspicious or unusual activity on your accounts or suspect fraud, be sure to report it immediately to your financial institutions,” continued the statement. “In addition, you may contact the Federal Trade Commission (“FTC”) or law enforcement to report incidents of identity theft or to learn about steps you can take to protect yourself from identity theft.”

Even though Target’s consumers will more likely be reimbursed with fraudulent charges, refunds might not come until after Christmas.