If they can't ascertain that security has been breached until after it happens, how can we be sure they are even aware of what was taken? They probably keep different bits of each persons info in separate servers and they should easily know which servers were breached. But is somewhat suspicious to me, anyway, that they are always saying "Oh, it was just your card number (or SS#), they didn't get anything else." Sure, and the tooth fairy doesn't record how many teeth are left, either...
"Suzy, did you really have 32
baby teeth?!"
