Yeah, well if you're not compliant with PCI-DSS then I wouldn't have too much sympathy if that occurred! The rules are not onerous or arbitrary, in fact PCI-DSS

Yeah, well if you're not compliant with PCI-DSS then I wouldn't have too much sympathy if that occurred! The rules are not onerous or arbitrary, in fact PCI-DSS reads like Chapter 1 of "Information Security for Dummies". There's a pretty good summary on the wikipedia page but it basically comes down to maintaining competent system/network security, not storing auth data like CVV2 and never displaying full card numbers, restricting access to the card numbers to those who need it and traceably logging it when they do, writing up a "policy" document which consists of stuff like "employees shall not disclose their passwords" etc, and commiting to test (and log that you've tested) the whole setup every month or so. No big deal. Most of it is kind of obvious. A decent operation is going to doing most or all of that stuff as a matter of course. It's just kind of a checklist really, formalising what you already know to be good practise. Nothing to be afraid of.