Report: Target hackers used HVAC-service company’s credentials