No surprise, at all. Massive data breaches are common, now.
I've been battling a hack that happened through my credit union over a year ago. They got everything. My info has traveled far out of the country, too. It has been unmerciful, fighting to keep control. It's been daily checking and changing info for over a year.
You can lock down everything, but once into your business, they'll figure out how to bypass it, in no time. It's not only electronic intrusions, I actually fear for my personal safety, as well, since these thieves got far too many personal stats that could invite some nasty thugs.
Robbing seniors is a joy ride for these folks and many fall for their phishing attempts, or fake sites that look legit. If they can be this good, why can't our greater minds, find these people, and drop the hammer on them. I would be for NO mercy.
But, all we hear is, 'oh, it happens, make out a report.' These reports go into dead files. Businesses will give you a obligatory contact for monitoring, with lists of all YOU have to do for your OWN protection. Would've been nice, if they protected us in the first place. Basically you're on your own. And, if your identity is stolen, you're toast!