I don't think that's how it works. (I just got mine) When you fill in the info you will get a 24-hour-expiring link at the email/phone number. You provide the

I don't think that's how it works. (I just got mine) When you fill in the info you will get a 24-hour-expiring link at the email/phone number. You provide the PIN to that to get the vaccine record. Presumably you can activate it multiple times, and the only way an attacker would be able to access it is if they have email/phone access in which case it's moot anyways.