Forever 21 says information from a third party suggested someone may have obtained unauthorized access to payment card data.
RELATED: 6 tips for protecting yourself against cyberextortion
The breach affects some purchases made between March and October of this year.
Forever 21 says an encryption used to hide personal data was not working and it exposed secure information.
The company has not said which stores were impacted.
Report a typo to the ABC13 staff