Target resulting in 40M debt/credit card accounts breached [Kerbs on Security]

Confidential report now published revealed Target had "no controls limiting their access to any system, including devices within stores such as point of sale (POS) registers and servers" according to Verizon's assessment: krebsonsecurity.com
Recall the attack source (though never confirmed nor denied) resulted from a Pennsylvania heating and air conditioning company that worked for Target – was hit with a malware via email which lead to the hack of Target's private network credentials. Target has since changed management/leadership, invested in security, etc. in the tunes of hundreds of millions of dollars (but does not believe rehashing possible scenario that is now 2 years old). An updated penetration test performed in Feb 2014 revealed stronger security controls and continued progress in remediating vulnerabilities on more timely basis.
Key penetration attack source / penetration testing concluded:

• Default and/or weak passwords store in servers even though password policy was in place. Combined with misconfigured services, allowed 86% (472,308) password to be cracked within a week
• System patching also were missing critical security patches, outdated or simply unpatched systems which was a patch way to gaining full access to the network / data

Finally, Target has not shared lessons learned but analysis would tell you the following: segment your network, limit access to sensitive networks, establish a system to finding and fixing vulnerabilities, and conduct penetration testing.