A prominent proxy advisory firm is recommending that Target shareholders vote out seven of its 10 board members after a massive data breach.

Institutional Shareholder Services on Wednesday targeted those members who serve on the company's audit and corporate responsibility committee. Included on that list are Anne Mulcahy, former chair and CEO at Xerox, and James A. Johnson, who was once the CEO at Fannie Mae.

The data breach, which led to the theft of 40 million debit and credit card numbers, has rattled one of the world's biggest retailers.

The board fired CEO Gregg Steinhafel three weeks ago. The company's chief information officer lost her job in March.

Target said that it views risk oversight as the responsibility of the full board.

"As one would expect, following the criminal attack that resulted in the data breach, the Board is reexamining the entire risk oversight structure, including senior management roles and reporting structures, as well as Board oversight," the company said Wednesday.

The ISS recommendation comes less than two weeks before Target's annual shareholder meeting.