you don't worry about having such a large cache of personal information in such a weakly protected storage location? Would you even be able to detect any ongoing intrusion?
You think his computers accept logins from anyone on the internet that types in his url, with a password that can be reset using his email and/or a security question?
