Staples Inc. said criminals stole personal information from as many as 1.16 million payment cards during the back-to-school shopping season at stores from California to Massachusetts.

The Framingham, Mass., company said machines were infected at 113 stores with malicious software that compromised customer data from Aug. 10 through Sept. 16. At two stores, the hack started in July, Staples said. (Click to see the full list of 115 stores affected.)

...