With all of the recent hacks out in the world, we are at least starting to see the government taking an interest in the how's and why's associated with the capture and storage of personal information. The government is the issuer of most of our ID's and so one would hope that they see the possibilities when it comes to centralised management of such data and by creating systems and services which vendors can use to confirm identities.. As per other comments, anyone is at risk of hack, including the government..
anyway, I digress...
To attempt to answer the question more specifically; in order to understand the cyber risk of any organisation you would first need to know exactly what data is being captured and stored by the entity. Then how that data is actually being captured and stored and in turn accessed, and accessed by whom, how and why.. The payments industry has for many years now taken a 'Scope Reduction' approach to sensitive data and for the most part this has worked fairly well. eg. minimising the capture and storage of card data in order to reduce / remove risk. Generally this is achieved by using payment service providers etc. Bu that then begs the question "how secure is my payments provider?..."
I'm hopeful that governments will take a more PCI DSS type approach to personal data and run with the ball.. to some degree this has begun with things like GDPR compliance.
Short of signing up for 1CG and looking for myself, it's going to be very difficult to know what data they capture and store. I'd have guessed it might actually not be too comprehensive; basing this on my Accountant and what data of mine they needed from me to get my taxes done etc. This was fairly minimal. TFNs, name, address and generic information etc
Any system is at risk of hack, that's not going to change anytime soon..
