Target says about 40 million credit and debit card accounts may be affected by a data breach that occurred just as the holiday shopping season shifted into high gear.

The chain said customers who made purchases by swiping their cards at terminals in its U.S. stores between Nov. 27 and Dec. 15 may have had their accounts exposed. The stolen data includes customer names, credit and debit card numbers, card expiration dates and the three-digit security codes located on the backs of cards.