. . . "Merchants and other organizations who handle secure cardholder data were required to be in compliance with the new standard by Jan. 1, 2011, but not all did so." .