Kevin Stevens, a security analyst with Trend Micro, said in a Tweet that "the hackers that hacked PSN are selling off the DB (database). They reportedly have 2.2m credit cards with CVVs" - the latter being the three-figure number required for "card not present" transactions. But Stevens added that he couldn't be sure the claim was true. The hackers were also claiming to have offered to sell the database back to Sony, but that the company declined it. Sony spokesman Patrick Seybold said that as far as he knew there was no truth in that claim. However, one man was contacted by Sony saying his credit card may have been compromised, shortly after, he discovered two new charges that piled up to $400.
Sony insisted on a blog post that the credit card data it stored was encrypted: "While all credit card information stored in our systems is encrypted and there is no evidence at this time that credit card data was taken, we cannot rule out the possibility.
"If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising you that your credit card number (excluding security code) and expiration date may have been obtained. Keep in mind, however, that your credit card security code (sometimes called a CVC or CSC number) has not been obtained because we never requested it from anyone who has joined the PlayStation Network or Qriocity, and is therefore not stored anywhere in our system."
The hackers seem to be European given the names they give themselves in there forums and seeing where the money is being spent.