The breach wasn't a one-off event, as believed, but part of a massive credit card skimming operation.