Reminds me of when one of my subordinates applied for an apartment and as part of the process the property management people reached out to me to verify his employment.

How? By forwarding me his unredacted application chock full of PII. When I pointed out that most people probably wouldn't appreciate their SSN and more being shot around in emails by the management company, I was simply told it was "standard practice" for them. Following insinuations that their "standard practices" might just be "fucked" were summarily ignored.