Having worked at a financial institution I can say that you might be surprised to see how loosely some connections to vendors can be, much less partners or acquisitions. As much as I like to hope that ADP raises the bar, I've seen some rather terrifying things in the past in the way systems can be interconnected.

RSA, BofA, Citi, Lockheed, now ADP... it's getting really scary out there. I'm rapidly losing any faith in the security of my information, whether they actively or passively have my consent to store it.