Same old story. I worked on a project last year for a company with a startup client that aggregated buying from name-brand retailers for consumers.

The personal shoppers were sending customer purchase data--credit card, name and address details--through email, and those emails were being stored (somewhat unconventionally) in a major customer support platform.