There's no evidence that PINs were stored on Target systems. PINs should be encrypted by the Verifone pinpad itself, using keys that were burned into the devic

There's no evidence that PINs were stored on Target systems. PINs should be encrypted by the Verifone pinpad itself, using keys that were burned into the device by the manufacturer. If the attacker compromised the pinpad device, then it's possible for unencrypted PINs to be intercepted at the point of entry. If the POS device or the store network was compromised, then encrypted PINs could be harvested on the wire.