I think we're still technology fixated - you don't need a pen drive or any other IT hardware to steal a few social security numbers or bank details - a pencil and paper works perfectly well if you have any access to the data at all. Not a high volume solution but that won't make the victim - or the regulator - any happier.