Your fears are not unfounded. I have had clients even in recent (<5yr) history that stored all their credit-card details unencrypted in the database - includin

Your fears are not unfounded. I have had clients even in recent (<5yr) history that stored all their credit-card details unencrypted in the database - including CVV. One client had a single table with all CC info including name, address and postal/zip code. One client didn't save it in their database, but had development logs enabled in production, saving all CC details to their logs for every transaction. We discovered they were enabled for more than a year. To the best of my knowledge, they have fixed these issues. Regardless I have seen such similar patterns often enough to know it's not an uncommon practice in spite of PCI requirements to the contrary.