American retailer Target has said that up to 40 million customers’ credit card details could have been stolen in a scam that began on Black Friday and lasted for up to three weeks before being discovered.

The retailer said it was conducting an investigation after discovering that thieves had gained access to its payment systems, taking credit card numbers, names, expiration dates and security codes.