And the PGP bug arises from the mistake that PGP originally made in not ensuring that all the additional decryption keys in the data-recovery field have to be signed to prevent the tampering.
If these card numbers were in fact stolen from the Playstation Network, it may be that the encryption Sony says it used was weak, badly implemented, or that the decryption key was included in the stolen data.