About 2.6 million payment cards at Michaels Stores and another 400,000 at subsidiary Aaron Brothers may have been affected in a card skimming attack that compromised its point-of-sale systems, the retailer said Thursday. Michaels said it had found evidence confirming that its systems and those of Aaron were attacked using sophisticated malware that had not been encountered previously by either of the security firms it had retained to investigate a suspected breach. It did not provide details of the malware.