Their methodology (not having actual access to PINs and trying to infer from numbers in passwords) may be flawed. I work for a company that, a long time ago, u

Their methodology (not having actual access to PINs and trying to infer from numbers in passwords) may be flawed. I work for a company that, a long time ago, used 4-digit PINs for account security. Our historical data (covering millions of accounts) shows that, overwhelmingly, the least-common PINs are those that start with the digit "0", which makes sense to me as a counter-intuitive PIN selection. Their comments about the most-common PINs do seem generally accurate, based on my data.