At least it's only in one database, and not all of them, like SSNs are...
At this point it's about doing that one thing the other 1 million won't. It might be surmountable but do you figure the adversary is going to have the incentive to surmount it?
"don't worry, your 12 digit pin is securely encrypted with md5"