Quote Originally Posted by User137 View Post
Also all data should be RSA-256+salt crypted which should take a millenium to break
This is assuming that all data was encrypted, hashed and so on. You would be surprised how many modern web sites and service still do not encrypt their data and sometimes even forget to hash passwords! In addition, as SilverWarior said, solving hashed/salted/encrypted password and/or credit card number for distributed computing is not a problem these days. Sometimes, when using additional information about the user (e.g. name, credit card bank & country) this information can be decrypted in minutes.

I'd say they've screwed up big time and it's yet another example why you should not let web sites remember your credit card information.