for i worked in several similar companies, indeed, its extremely rare that such data is well protected. it works under the assumption that if its not been broken into until now then its safe enough.

obviously that's broken logic since..

- you're not compromised by default/when the business starts

- when you're compromised, you probably don't even know it. you might find out in a few years if lucky.