The breach may have lasted for several months, making it potentially far more damaging than last year’s three-week-long Target breach.