> Not that many years ago I was still seeing people storing > credit card numbers in plain text files on servers, and > sending them unencrypted via email.

I've seen it in the last week. I work for an ESP, and have to continually tell customers "just because you can store CCs (or SSNs, or private account #s, etc) in our database, there's never a good reason why you should" and "PCI? Heard of it?".