I would like to report that my SPG account just got hacked as well.
I tried using my ID and password to log into my SPG account via the website but was unsuccessful. Then, I typed in my SPG card number and password to log in and was still unsuccessful. Upon calling SPG, I have found out that my account has been hacked and someone has used my account to redeem for free iTune and Amazon gift cards.
SPG immediately looked into my account and cancelled all such redemptions as well as deposited all my lost SPG points back to my account. I think SPG handled this situation pretty well, and they will provide me with an investigation report hopefully in the next few days.