Target Hackers Used a Vendor's Credentials