Merchants who require the CVV2 for "card not present" transactions are forbidden by Visa from storing the CVV2 once the individual transaction is authorized and completed. This way, if a database of transactions is compromised, the CVV2 is not included, and the stolen card numbers are less useful. The Payment Card Industry Data Security Standard (PCI DSS) also prohibits the storage of CSC (and other sensitive authorisation data) post transaction authorisation. This applies globally to anyone who stores, processes or transmits card holder data.

Supplying the CSC code in a transaction is intended to verify that the customer has the card in their possession. Knowledge of the code proves that the customer has seen the card, or has seen a record made by somebody who saw the card.

"We had to temporarily take down SOE services during the night," a spokesperson said. "In the course of our investigation into the intrusion of our systems, we have discovered an issue that warrants enough concern. We will provide an update later today."

No timetable was provided for when the services will be turned back on. Sony Online Entertainment hosts several massively multiplayer titles, including: DC Universe Online, the Everquest series, Freerealms, Star Wars Galaxies, and Planetside.

In a message to its customers, Sony said: "We had previously believed that SOE customer data had not been obtained in the cyber-attacks on the company."

However, it added that "on 1 May we concluded that SOE account information may have been stolen".

Sony was quoted by the Associated Press (AP) news agency as saying that the latest incident occurred on 16 and 17 April.

This was earlier than the larger Playstation user security breach.