I would expect a company to guard customers' passwords every bit as carefully as they guard customers' e-mail addresses, and probably moreso, yes.