The bit about the federal government not being required to alert users to any security breaches is alarming as well.

I guess that's not surprising. But, "monitor your own credit" isn't a risk I'm willing to take just to use a barely functioning website.