If they were doing it right the DB would be encrypted and the PCI fields would be tokenized and then if you get dumps of the DB you don't have anything you can use.