> Stolen credit card data included the three digital security code - known as the CVV number - on the back of the card itself. I always thought that PCI-DSS st

> Stolen credit card data included the three digital security code - known as the CVV number - on the back of the card itself. I always thought that PCI-DSS standards mandate that the CVV must never be stored; I get that card number and expiry date may be stored for customer convenience purposes, speeding checkout when returning for a second purchase, but how on earth could they be compliant if they are stashing away CVVs somewhere?