This situation is a great example of a lesson learned by the ADA. Physical media can not always be trusted. The article by Krebs has images of the drive in question.
http://www.infosecurity-magazine.com/news/american-dental-association-mails/
http://krebsonsecurity.com/2016/04/dental-assn-mails-malware-to-members/