The PM hack took advantage of a XSS vulnerability a while back. The last upgrade was performed to fix this issue. I haven't seen anything that makes me think the PMs have been hacked since. I've upgraded the forum software to the latest version, but I wouldn't put my credit card numbers in PM.