TORONTO, Canada — Hudson's Bay Co. fell the most in four months after a data security breach may have put millions of the department-store company's customer payment cards at risk.

The retailer said on Sunday it is investigating a breach on cards used at certain Saks Fifth Avenue, Saks Off 5th, and Lord & Taylor stores. Security firm Gemini Advisory wrote in a post that details from more than 5 million credit and debit cards were stolen by a hacking syndicate, which is gradually putting them up for sale.

Hudson’s Bay shares fell as much as 7 percent to C$8.30 Monday in Toronto, the biggest intraday decline since December 6. They had already dropped 21 percent this year through March 29. Markets were closed Friday for the Good Friday holiday.

The theft further clouds the outlook for the company, which has been struggling to win back customers increasingly turning toward online retailers like Amazon.com Inc. Last week, Hudson’s Bay reported fourth-quarter earnings that missed estimates and a decline in same-store sales.

“We identified the issue, took steps to contain it, and believe it no longer poses a risk to customers shopping at our stores,” the company said in an updated statement on Saks’ website Monday. The investigation is continuing, it said.

There is no indication that e-commerce operations were affected, according to the statement. Hudson’s Bay urged customers to flag any unfamiliar transactions to their card providers and said they won’t be liable for fraudulent charges.

An external representative for Hudson’s Bay declined to comment on Gemini’s report.

By Sandrine Rastello, with assistance from Rachel Evans; editors: Crayton Harrison, Lisa Wolfson and David Scanlan.