this was my reaction, too. and I'd add: the legal requirement is basically to have 'industry standard' security; no more and no less. there is no legal requirem

this was my reaction, too. and I'd add: the legal requirement is basically to have 'industry standard' security; no more and no less. there is no legal requirement to have air tight security (which probably isn't even technically possible at a company of this scale anyway).