Holy hell-in-a-handbasket. I know for sure that both my wife & I have shopped at Marshalls in that time frame.

"The company does not know the extent of the breach, which was first discovered in December 2006. However, hackers may have made off with credit and debit information from transactions in the United States, Canada and Puerto Rico in 2003 as well as transactions between May and December 2006, according to a company statement."