UPS was hacked sometime between March 26 and Aug. 11. That was when the malware was removed.

“We know it is our responsibility to protect customer information, and we have taken a number of steps to ensure that customers can remain confident about doing business with The UPS Store centers network,” UPS said in a statement.

Credit monitoring and identity theft services will be provided to customers for one year. An internal review is underway, and The UPS Store said it has retained an IT security firm.

The breach affected 51 of its franchises in 24 U.S. states.