Which of the following scenarios represents an IG 'information risk' rather than an IT security risk?