It might be on a flash drive owned by a government employee and it probably isn't encrypted.
KATU has the story of a lost flash drive containing social security numbers for about 300 Oregon Dept of Corrections employees. It's not clear whether the Dept had a security policy in place regarding portable storage. These incidents are preventable with the right combination of technology and security policies.