Absolutely! The same way we say you have to hash and salt passwords so they're not useful for cross-site breaches, it's even more important for any other piece of information that is used to verify identity. Especially since these other pieces of info aren't easily changed and can't be different on different sites. Or, facts about a person shouldn't be considered secret for the purpose of authentication, but that's hard when people have trouble with being asked to keep track of any new secret pieces of information they are given.