> the attackers had card-sniffing malware installed on every single cash register

Part of the attack was physical, aka skimmers. I still remember the relatively elegant inspection tool blogged by Target Tech on HN 3 years ago:

Target's EasySweep – Simplifying Skimmer Detection: https://news.ycombinator.com/item?id=36788831