It would appear that they have a very serious systemic security problem in their organization. Their "Director of Information Security" is obviously very very incompetent, there wasn't any real resolution after many months even though they claimed it was fixed. There's no way that a single person or even just a handful of managers could be solely to blame for this.

If this is how they respond to security issues I think it's a fair bet that they're making the same mistakes that e.g. Target and Home Depot did. Who's to say a VPN connection for some lowest bidder third party vendor hasn't already been used to exfiltrate tons of credit card details?