...Unless they're RSA SecurIDs. Although it seems that whoever got that info used it for poking into defence contractors, rather than banks. Still, I imagine

...Unless they're RSA SecurIDs. Although it seems that whoever got that info used it for poking into defence contractors, rather than banks. Still, I imagine it's perfectly possible they could have used it to defeat some multi-factor logins for large bank accounts. I wonder how long the recall and replacement will take; there's got to be a lot of those tokens out there.