Michaels may have been hit by a security breach