Going after the one with the least care factor first would make a lot of sense, assuming their cryptographic implementation is inline with their care factor.