It should be common place for all companies no matter how small to encrypt everything especially PII like credit card numbers. How many more companies have to get owned before this is taken seriously.