I don't think the "how" has been revealed, but theories are that they didn't necessarily get the data from any stored location but could have skimmed it at the

I don't think the "how" has been revealed, but theories are that they didn't necessarily get the data from any stored location but could have skimmed it at the time of usage (malware at the card scanner/register)