Personal information is a lot easier to steal than most people realise. So what are the implications for business security?