Citigroup suffered about $2.7 million in losses after cybercriminals uncovered a way to lift credit card numbers from its website and make fraudulent transactions.

Citi acknowledged the breach earlier this month, saying hackers had gained accessed to more than 360,000 Citi credit card accounts of U.S. customers. The hackers didn’t breach  Citi’s main credit card processing system, but were reportedly able to obtain the numbers, along with the customers’ names and contact information, by logging into the Citi Account Online website and guessing account numbers.

Until now, it wasn’t revealed if any fraud had occurred as a result of the theft. But Citi confirmed Friday that there were losses of $2.7 million from about 3,400 accounts.

The bank has said its customers will not be liable for the fraudalent transactions and losses as a result of them.

Citi discovered the hacking on May 10 and began notifying customers on June 3. The bank said other sensitive data, such as Social Security numbers, birthdates and the cards’ CVV (Card Verification Value) security codes used for online transactions, were not taken.

In addition to the fraud losses, Citigroup will have to pay the cost of notifying customers and reissuing credit card numbers for the 360,000 affected clients. The Ponemon Institute has estimated the average cost of a data breach at $214 per compromised record. By that yardstick, the breach would cost the bank $77 million.