A client passed this along to post.  They started to receive statements via email.  The pdf statements had the account numbers blocked, but all the financial info was there.

The client emailed the financial institution to indicate its displeasure, saying that email was not a secure channel, the statements contain sensitive business information, and they were not given an opportunity to opt in or out.

The reply was rather ironic:  A return email saying they required more information to be able to assist, but since email is not a secure channel, the client must call them.