Hackers can steal credit card data from used Xbox 360s
Of course they can.
1. Microsoft's operating systems eat memory like a starving man at a buffet. When they run out of real memory, they start using the hard drive. It's pretty much inevitable that personal information will be written to the drive, even if the OS never does it intentionally.
2. Any "wipe" or "format" option offered by the console almost certainly does a 'quick' format that just wipes the directory rather than zero-filling the drive. I doubt that any users are going to sit there and wait for a true format to finish. As an aside here, I really HATE how MS has muddied the waters in regard to "formatting" a drive. The word "format" used to refer to completely erasing a disk by overwriting all the tracks and sectors. Then MS came out with the "quick format" option, which only erases the directory and marks the space as free. Now, probably 99% of the average users think that a quick format completely erases the drive.