It is also a legal issue, depending on what else is on the drives. Imagine having to call your employers or clients and tell them that data under NDA is being turned over to Seattle's auditors.

Worst case, they'd want to know exactly what data was at risk, which would trigger more demands for forensic audits and more duty to notify.