Someone, somewhere, is mapping out all the sites that ask that as a "security question", and they'll be ready to add to their dictionaries when one of those sites is breached.