That's entirely possible, especially if the site is small and not run by people with access to resources like physical security, legal etc.