The thieves were quite clever. Most of the time when thieves go to infiltrate a business with card skimmers, they replace the actual card reader with a compromised unit. This time they went much smarter: they installed a keylogger in the port between the card reader and the computer cash register.
They also got caught on security cameras distracting the employees first to photograph the register setup, then to install the logger.
http://krebsonsecurity.com/2013/10/nordstrom-finds-cash-register-skimmers/