I remember a bank I used to work at got bought out by Suntrust. After we had been migrated over, for some reason I had decided to check out the cookies they were using. Sure enough I saw my full SSN there. They don't do that now, but even as a junior developer at the time, I was pretty taken aback.