I've spoken to a number of employees who have confirmed they are stored plain text.
I have considered those factors and am definitely concerned. However, consider the other side of the equation: a systems breach that leaves thousands (maybe even millions, given their size and 15 years of operation) of customers data being leaked, potentially leading to fraud and identity theft.
Who deserves to be protected? The organization that will not respond to the threat, or their innocent customers?
