That's unfortunate. I guess it goes to show how much value those "Hacker Safe" badges are. But how do you know they store your password as plaintext?

I was talking about the way they handled it in general. They didn't email any customers, and they still don't know which cards/orders were affected. I think they should at least be able to tell me which customers have been complaining (ex. those who made orders between DATE_A and DATE_B)

Also, they deleted data that they previously assured me would be kept & accessible (last 4 digits of credit cards, so that I can check the appropriate bill). It took me over a week and at least 5 different CSR's to find this out- I was given the runaround before that. Live support & phone support both told me they couldn't help, and claimed that the email support team is the only group that could. Over a week later, I still have not received a response.