Wow. Not as bad as the Ledger leak was, but still unacceptable especially for a company that sells security devices. As far as I'm concerned you're always fully responsible for how third-party partners handle YOUR customers' details. This is one more reason why I only ever recommend @NVK Coinkite stuff.