Surprised at the amount of data...
that they were able to steal just from credentials stuffing.
I'm on the UK version of the website, if I log in without 2FA, the only information I'll be able to access is my account numbers, those of my payees, my transaction history and my postal address (the latter by downloading a statement). All other information (email address, DoB, phone number..) is protected by 2FA, so the security of the US website must be absolutely terrible if that's not the case.
Biting the hand that feeds IT
