While on the level of individual users, that is not a surprise. The kicker is that the "professionals" are incredibly sloppy at best.
Financial services, gaming outfits, and worse cloud services continually prove that they either have no clue or refuse to spend the $ to secure your data.