Before revision: The breach of CVV codes in the attacks support this theory, as by PCI DSS standards CVV codes are not URL and are only processed during the time payments are made which makes access to a database unlikely.
After revision: The breach of CVV codes in the attacks support this theory, as by PCI DSS standards CVV codes are not stored, and are only processed during the time payments are made which makes access to a database unlikely.