Comment by Tangurena2

In the 2013 Target attack, the attackers used the HVAC contractors' credentials to gain access to Target's systems. The point of sale credit card terminals (what customers swiped cards and enter PINs) had no real security so the attackers were able to make those get "updates" from their own servers and download malware enabling them to get the magnetic stripe information as well as PIN (for debit cards). That year, I (like about 150,000,000 other people) got a brand new credit card with a new credit card number.

https://krebsonsecurity.com/2015/09/inside-target-corp-days-...

Newer PCI standards require much more secure customer-facing terminals and much more secure back-end systems so that much of this attack could not happen again.

https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Sec...