The attack on the British retailer shows that compromising a single identity can lead to much deeper penetration of the corporate network.