it's just data sanitization. there may be other datasets tying OP to the former last-4-digits. it's still (sort of) personally identifiable even if it's defunct.