> It also seems that they don't encrypt social security numbers and other sensitive data; I imagine if they did they would have mentioned it.

That's really scary and feels like it is more than basic in 2021. I really wish we had legislation to protect users against this type of stuff, or at least to grant them some avenue for compensation.