Do they say somewhere that they&#x27;re only using sha1 though? That&#x27;s sort of what I meant: if bcrypt or scrypt is used, with an appropriate work factor, the risk should be very minimal. The fact that they&#x27;re assuming it&#x27;s not suggests they are using weaker encryption.