>None of that is surprising - that information is commonly used as security challenge questions in phone support situations. //
The PIN at least seems like it should have been hashed, then an employee puts in a form the stated PIN to see if it's correct and the hashes are compared on the backend.
The other info though is needed for initiating contact and to allow customers to perform transactions (verifying card details for example).
Hashing wouldn't help much for a PIN (which is usually just 4 digits). You could get a rainbow table for that in like 5 seconds. Even salting wouldn't help, given how tiny the keyspace is.
The PIN at least seems like it should have been hashed, then an employee puts in a form the stated PIN to see if it's correct and the hashes are compared on the backend.
The other info though is needed for initiating contact and to allow customers to perform transactions (verifying card details for example).