I’m honestly shocked it took this long tbh. It’s obviously a liability, the only question is what site is going to be sued into oblivion first, and a lawsuit would name everyone in the chain, from the site hosting it, to the cloud provider with the data on it, to the card processors. Whoever loses will be “made an example of” too, more than likely shuttering the doors of the site.