(...)
Staples’ data security experts detected that criminals deployed malware to some point-of-sale systems at 115 of its more than 1,400 U.S. retail stores. Upon detection, Staples immediately took action to eradicate the malware in mid-September and to further enhance its security. Staples also retained outside data security experts to investigate the incident and has worked closely with payment card companies and law enforcement on this matter.
(...)
Overall, the company believes that approximately 1.16 million payment cards may have been affected. Specific stores and dates can be found here.