The scale of the attack had me thinking the PINs were taken from a server. I feel much better with the answers provided here, but yeah, I'm still going to start changing my PIN periodically. At what frequency I'll have to see...

Thanks for all the answers.