According to Brian Krebs, the likely vector for the hack is Select’s PoS vendor.

Lack of public consultation over data sharing agreement and no regulatory oversight criticized in academic report