Apparently there's already someone trying to sell the CC numbers:
It doesn't really matter if Sony encrypted the CC numbers because they are just 16 digits long, and they almost always start with 4, that means that there are around 800.000.000.000.000 possibilities for a CC number (it's actually much less since the Issuer and Bank identification numbers are much smaller than 9999). Considering that 10 chars long passwords, which using a case sensitive algorithm have something like 80.000.000.000.000.000 (that's 80.000 times more than a CC number) possible combinations, are considered unsafe these days, decrypting CC numbers is a walk in the park.
The question here is if the hacker knows the encrypt algorithm used, and if Sony used a slow or fast algorithm. If they used something like MD5, SHA (which are fast algorithms) then I'm sure that all the numbers will be exposed, if they used a slow algorithm like for example BCrypt than it will be much harder, the difference being that with for example MD5 it takes about 40seconds (using a brute force attack, for CC numbers you can use an Hash table, which is much faster) to decrypt a 6chars long password and with BCrypt it would take around 12years.
Tl;dr: Sony should have never stored the CC numbers.