I do hope that this silly ex marketing women tries to defend this useless company in court.
May be not a criminal offence, but in Civil and Common law she and the company have a problem.
A company and its officers and servants have a duty of care to protect the property and information relating to their customer from theft, misuse and any loss, damage or otherwise if the comapn, its officers and servants fail to use all reasonable methods to prevent loss, damage or abuse.
Reasonable methods within the industry would be the de facto standard encryption.
Please some one sue this arrogant women and Talk, Talk using Civil Law.