Yes - it would be reckless to store users' login attempts (correct or incorrect) in the clear, no matter the purpose. And I've never heard of anyone doing that - it's pretty self-evident.