That’s not a requirement. You can make payments without one though the odds of approval aren’t great. If the actual real card numbers got leaked, you need to cancel that card. Also if they actually leaked REAL card numbers, Epic is going to be in deep shit with the card brands.
This article has no real details though so we’ll see. I kind of doubt this is legit.