Who knows, but it might be that no credit card numbers were stolen. If you want to accept credit card payments, the industry requires PCI compliance (https://e

Who knows, but it might be that no credit card numbers were stolen. If you want to accept credit card payments, the industry requires PCI compliance (https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Sec...), which actually does involve taking substantial steps to protect those card numbers. An outside organization does some amount of validation that you're handling the card numbers in a reasonable way. There's a difference here, which is that if personal details like names, date of birth, and driver's license are leaked, it affects individuals' interests. But if card numbers are leaked, it affects the interests of huge corporations. Those corporations have the resources and power to get involved and protect their interests in a way that consumers don't.