No, it hasn't. I'm just jumping the gun in a frothy rage.

Something this egregious should have been caught by PCI compliance checks (if not development) in the first place though.

I doubt the penalty will be anything severe enough - something like "no cc processing and management for citi for 180 days" might make them take this a bit more seriously.