Before both breaches IntelCrawler detected large-scale RDP brute-forcing attacks on Point-of-Sales terminals across the US, Australia and Canada started at the beginning of 2013 year in winter period with week (weak?) passwords such as:
"pos":"pos";
"micros":"micros" (MICROS Systems, Inc. - Point-of-Sale Hardware);
"edc":"123456" (EDC - Electronic Draft Capture).