Unfortunate. I've known TPL's system has been relatively insecure but that also made things convenient when it came to PINs and stuff...

For their employees this sucks.

What a clusterfsck. That's just awful.

I never understand companies, corporations and services asking for and documenting SIN numbers .... I learned decades ago that the only entity that should use your SIN is the government. I was taught that banks don't even need it ... they say they do but it isn't necessary.

Because once your SIN is compromised ... it will be absolutely terrible to do anything about it.