"Let's talk about that CVV for a moment. ... PCI DSS is very clear about how the CVV (or CVV2 as it is these days) should be stored ... It shouldn't be stored and that's what makes this breach such a big issue. Violation of PCI DSS guidelines can lead to pretty serious fines and even loss of merchant facilities; the card providers take this very seriously.
I learned this the first time I was implementing a system. They gave me the guidelines and I was like, good deal, no CVV. Pretty easy but how many developers actually ever see real requirements?
The author doesn't explicitly mention it, but the CVVs were saved as a part of debug logging. That mistake should serve as a warning to others implementing PCI DSS systems.
Where do you have that information from? I've seen the theory in the comments on troy's website, but no confirmation of it. My kid's after school program got hit and I'm working with them to translate Regpack's obfuscation of what went on and ask some pointed questions.
