Ignorance and being oblivious to the repercussions of not taking every possible precaution to prevent personal information from falling into the wrong hands can mean not only loss of of thousands of dollars but also loss of personal identity, hassles of retracing the steps, remediation, and the extreme stress one has to go through during the ordeal.
As in this case, employees may not even begin to understand the gravity of securing personal data unless they are properly trained. It is a combination of putting controls in place, testing, training, implementing, verifying and revisiting the steps to make sure that it is ongoing.
