The security breach at the arts and crafts retailer lasted for eight months and affected roughly three million accounts.