Target Corp. announced Friday that personal information from asmany as 70 million people may have been stolen in the data breachthe company originally announced on Dec. 19.

The announcement upped the ante on the nature stolen data, asthe new security breach numbers are in addition to the 40 millioncards the the Minneapolis-based retailer had previously said hadbeen compromised. Target also said the breach may have lastedlonger than original dates of Nov. 27 to Dec. 15.

“As part of Target's ongoing forensic investigation, it has beendetermined that certain guest information – separate from thepayment card data previously disclosed – was taken during the databreach,” the retailer said in a release.

That includes names, mailing addresses, phone numbers or emailaddresses for up to 70 million people, the company said.

Read more about the Target breach.

The new numbers now mean the breach has eclipsed the estimated90 million accounts affected by the years-long TJX breach before its discovery was announced in 2007.

Target said much of the data stolen is partial in nature andadded it would be contacting customers for whom it has emails,offering information about guarding against consumer scams.

The company also reiterated that its customers have no liabilityfor fraudulent charges arising from the breach and that it isoffering a free year of credit monitoring and identity theftprotection to anyone who shopped at its U.S. stores.

“I know that it is frustrating for our guests to learn that thisinformation was taken and we are truly sorry they are having toendure this,” said Target Chairman and President/CEO GreggSteinhafel.

The announcement also said that Target sales and earnings havebeen impacted by the breach, reporting “meaningfullyweaker-than-expected sales since the announcement, which have shownimprovement in the last several days and a comparable sales declineof 2% to 6% for the remainder of the quarter.”