[Sottilde]

And imagine how much being hacked affects revenue!

I don't doubt, though, that some sort of similar short-sighted thinking led to this decision. Is it really possible that such a large organization simply doesn't understand password policy? Not to mention, an organization that's on the board of PCI-DSS?

[jiggy2011]

Possibly not that much, as long as their security is good enough that they don't get sued.

At the point where you are worrying about hashed passwords, your system has already been owned.

It also depends on public reaction to the incident, people won't necessarily blame tesco either and blame the "1337 chinese super h4x0rs"