I think the point here is if your data has been breached you should be reassuring people that password and payment details even if accessed aren't easily readable.