It might be on a flash drive owned by a government employee and it probably isn't encrypted.

KATU has the story of a lost flash drive containing social security numbers for about 300 Oregon Dept of Corrections employees.  It's not clear whether the Dept had a security policy in place regarding portable storage.  These incidents are preventable with the right combination of technology and security policies.