I know I've said similar in every thread about data loss that has been posted but if a company had managed to bollix up data losses with the regularity of the government they would have been shut down long before now.
And once again its down to an elementary cock up. Posting CD's has to be one of the worst ideas going. If you have to send them in that fashion then use PGP encrypted disks and send by an approved business courier, at least they will sign for it and ensure it gets where it is supposed to.
However the transfer could just have easily been done using a secure FTP server.