[entwisi]

I'm more surprised that in these days of fast encrypted links they still send a physical piece of media.

The data should have at very least been encrypted. As most know I work for a Bank. I deal with Live systems and can tell you our internal processes state that data must be encrypted if it moves even if it is only internally within a server in a secure environment. e.g. if a server makes a call back to itself the request never even travels outside the physical unit yet it MUST be encrypted. These are computers that even though I am responsible for keeping them running I am not under any circumstances allowed in the same building as them.