Depending on the system they can still get an account/card number. They shouldn't be storing it but...

They can certainly get cardholder names and that sort of thing though. Maybe they've figured out a way to generate a unique token based only on non-secure data.