That's kind of a scary part to it. Large organisations don't colocate code and credit card numbers. They carefully segment things and isolate them to completely

That's kind of a scary part to it. Large organisations don't colocate code and credit card numbers. They carefully segment things and isolate them to completely separate silos in completely unconnected systems. So I would infer that the attackers obviously had access at a very high level, probably compromising the credentials of someone very senior with very high privileges. Which in turn means they could almost certainly have compromised the encryption keys and would be most likely to do so before downloading the actual CC data.