There should be many safeguards in place to prevent things like this from happening, but yet you hear about it happening more than you would like and more than what is acceptable (which is never) - data breaches. In this case, simply encrypting the data on said tapes would have provided some level of protection should their physical security fail - as it did here. As a matter of fact, as far as I am concerned, unencrypted NPCI should really never leave in the hands of a third party without documented safeguards. There are some things you can control - and defense in depth is one of them.