I have some professional experience in this arena.
Yes, it is highly unlikely that Target was able to make all the changes necessary on the 15th or within the following 3 days (before they publicly confessed on the 18th) to eliminate all the vulnerabilities from their software and system. They might have been able to quickly implement some network changes to firewalls, close any compromised user accounts on servers, and the like, but if the attackers had multiple ways into their network and access to other user accounts, then the attack could, in theory, be ongoing.
Often, fully addressing this kind of thing requires some significant software redesign which can take weeks (or longer) of coding plus quality assurance testing before it's ready to be deployed.
Their 10 percent discount could not have lured me back in there with a 10 foot pole. A 90 percent discount could not have; anyone who uses a card at Target right now is asking for problems.
Who knows if the OP had ever used his or her card anywhere else, or used it at Target during the publicly acknowledged risk window, or if Target's breach is even the source of the fraudulent charges on their card.
I just know that from being in software design myself, and having dealt with external attacks as part of my work, I would not use a card at Target for a little while yet.
