Credit card numbers by themselves are no big deal, but this will haunt Blippy forever. I don't know how you can recover from a PR disaster like this.
Slightly melodramatic. No one will care tomorrow. We'll all be on to being outraged by something else.
In the US, it depends entirely on the merchant. They tell the CC processor how secure they want it to be. A lot of them only need the CC number and any expiration date in the future.
Not all online credit card processors require a CVS code. I don't know if you can try enough different expiration dates before it gets shutdown for fraud.
Being pedantic, it's often called a CVV code, or a number of different acronyms, but none of them are CVS afaik.
In general, having the wrong CVV code will decrease the chance of the purchase going through, not stop the transaction completely. If you have, for example, the wrong CVV but the correct address and name, there is a good change the transaction will go through any way.