Couldnt agree more. Regardless there will always be a risk when you supply any personal information to a vendor for what ever reason. The best they can do is have policies and procedures to mitigate said risk before and when an issue arises. I feel that they did just that.