US transaction processor Global Payments says that "less than 1,500,000 card numbers may have been exported" as a result of a systems breach.
Following media reports, the company was forced to confirm on Friday that it had identified and reported unauthorised access to its processing system in early March.
It is thought that only North America cardholders are affected, with 'Track 2' data - including account numbers - compromised but not names, addresses and social security numbers.
News of the breach saw trading in Global Payments shares halted after their price plunged by as much as 13.7% on Friday.
Visa has also removed the company from its list of approved service providers, telling it to revalidate as PCI DSS compliant.