And it's still a problem since everyone uses it as a secret, not a username. So if leaked, you are still at risk. This is why the number realy should have been public from start so companies would not get the idea to use it as password.