Unless/until Tesco have their databases hacked or stolen there is no risk at all. This is not the case. The most glaring reason why was pointed out in the post

Unless/until Tesco have their databases hacked or stolen there is no risk at all. This is not the case. The most glaring reason why was pointed out in the posted article. It very clearly showed that Tesco failed to communicate logged-in state information (stored in a cookie) between the client and server over an encrypted line. This means your account is vulnerable to attack without the entire db being leaked.