Did Jones receive the valuable CV's in a secure way?
Obviously they weren't sent via the VPN.
Jones has a certain level of insecurity in that any access to remote servers leaves all sorts of footprints, including passwords, cookies etc. Servers are regularly attacked for their data. There is no end-to-end encryption.
Using a VPN protects you only as far as the VPN server; on the other side its just like you entered plain text.