I didn't - but isn't that why I am encrypting the data - so that if somebodu does get a login all hell see is gibirsh.

If the user does not get a login in the first place - then what's the problem , why even encrypt?