Big red flag that they don't understand the distinction made by the requester over there. I'd be seriously concerned if I had sensitive data in their systems.