Its obviously a c*ck up of a big order and a silly middle manager is going to get chewed out. The press release stated that the disks were subject to the appropriate degree of security. Interestingly, it didn't say that the disks were actually within that level of security at the time of theft. It looks like someone didn't put them away or the access codes were not properly managed.
The bank details thing should not be a problem. Every time you write a cheque you tell anyone who reads it, what your details are. The RAF should not have your PIN and other private passwords to permit withdrawals from your account. Anyone who has my bank details can credit my account any time they like.