More story time.

I worked for a firm providing services to a large revolving consumer credit organization. These companies are essentially two things: a really impressive transactions processing network (the volume of traffic they handle is immense), and branding.

Think of all the credit card commercials you've seen. That's the branding side at work.

As a contractor of theirs, there was a requirement to go through their data security training.

And while, yes, PII (personally identifiable information) was a concern, the vast bulk of the message, and emphatically highest concern, was with the brand, business plans, and similar information. That is, a company with vast holdings of personal information (described by a military acquaintance with intelligence ties in the late 1990s as "more than we've got" from the perspective of the TLAs, though that status may have since changed), was more concerned with how its trademarks and marketing campaigns were protected was ... revealing.