This is nitpicky, but shouldn't the title (on Ars I guess, since it was used verbatim) be "was compromised" since this was a one-time data theft that rendered all currently-live SecurID tokens useless?
True, on the other hand there are still 40 million of those tokens out there, which are all compromised and have to be replaced. So that is still very much present tense.
