Read more here
http://krebsonsecurity.com/2014/01/a...lware-part-ii/
It can't be just a 17 years old Russian kid. I think it is an entire organization and as many (also in the link) suggest there could be someone from the inside also. The malware and the attack was specifically designed to "target" Target stores.
I think we can assume that there will be an intense chargeback period
This is an interesting lecture also
http://krebsonsecurity.com/2013/12/w...s-from-target/