Essential may have accidentally shared customers’ driver’s licenses

I understand why the article is focusing on the "misconfiguration" but the real mistake here is asking for (and providing) sensitive data via email at all.