Nothing would surprise me. I take precautions where it's practical, but I'm very much aware of what the IT landscape looks like. It's literally impossible to prevent some entities from accessing your data, but it's not difficult to deny access to most of them.
