I said nothing about swiper skimming.

What I said was:

> What the criminals are targeting is the card terminals themselves. Meaning when you swipe your card, as the transaction is being conducted they take a copy of the information and re-transmit it to a host somewhere they control (or to a C&C machine on that network, which they then exfiltrate somehow).

Which is accurate:

> The apparent credit and debit card breach uncovered last week at Home Depot was aided in part by a new variant of the malicious software program that stole card account data from cash registers at Target last December, according to sources close to the investigation.

So malware was intercepting the raw CC information inside the card terminal on its way to the payment processor upstream. This allowed them to remotely infect every single Target store in the country, and steal information without setting foot there.

http://krebsonsecurity.com/2014/09/home-depot-hit-by-same-ma...

Ah, the distinction being that it wasn't stolen in a single bulk breach or via a device placed between the card and the scanner. Fair enough.

Yep, lots of these point-of-sale machines are (still!) running XP Embedded which is, AIUI, pretty heavily targeted. Apparently -- but not surprisingly -- they aren't updated all that much so they're pretty susceptible to being compromised.