From what I've read on CNN, Target hasn't specified exactly how the breach occurred.
http://money.cnn.com/2013/12/18/news/companies/target-credit-card/index.html?hpt=hp_t2
I'm not surprised that the breach itself happened, there are always those trying to do these things out there. What does surprise me that it could have happened for nearly three weeks:
- from targets standpoint: it shows a flaw in their system;
- from the thieves standpoint: it just increases the probability of getting caught.
I must Thank you DrJHBL for bringing this to my attention. I do hope that the investigation leads to some better precautions on these systems, not to mention the capture of the thieves themselves.