Merchants are required to scrub the card details as soon as the business need for them has passed. In the case of a retail store, I would think that would be as soon as the accept or decline response from the payment processor is received.
To make a charge, the POS terminal packages the mag stripe data (and the encrypted PIN-block if doing debit) together with the POS terminal's ID, the amount to be charged, and maybe the CVV2 or the billing zip code, etc., into an HTTPS request to the payment processor. A second or two later, the payment processor responds, and the terminal completes the transaction.
If that's how Target's POS terminals work, then the hackers probably managed to push a "software update" out to the terminals causing them to tee the data off to the hackers' server whenever a transaction was made.
The reason the debit PINs were safe is that the PIN pads on which the customers enter their PINs are separate self-contained devices which encrypt the PINs before they leave the pad. Only the payment processor has the key needed to decrypt the PIN blocks, and PIN pads don't accept "software updates". PIN pads have been hacked in the past, but such attacks are far less scalable because they require modifying hardware at each affected POS terminal.
The new news about Target breaching contact info for 70m customers simply confirms that the hackers had free reign on Target's corporate network.