Yes, and assuming you know a few other things about a customer finding them becomes trivial. This is negligent although sadly common.