67 percent of used drives for sale contain sensitive data
An analysis of 200 second-hand hard disks and solid state drives purchased from eBay and Craigslist in the first quarter of 2016 reveals that 67 percent of them contained personally identifiable information.
In addition 11 percent held sensitive corporate data, including company emails, CRM records and spreadsheets containing sales projections and product inventories. The study comes from mobile diagnostics and secure erasure specialist Blancco Technology Group.
"With the Ashley Madison hack, in particular, users who wanted to make sure all of their data was erased from the dating site put all of their trust into the site’s $20 'Full Delete' program," says Paul Henry, IT security consultant for Blancco Technology Group. "Even though the obvious identifiers had been removed, enough information was left to expose the site's users. The big lesson for Ashley Madison -- and any other type of business -- should be to test that your deletion methods are adequate and to not blindly trust that simply 'deleting' data will truly get rid of all of it for good. Remaining data can still be accessed and recovered unless the data is securely and permanently erased".
Blancco's digital forensics experts found company emails on nine percent of the drives, followed by spreadsheets containing sales projections and product inventories (five percent) and CRM records (one percent).
On 36 percent of the used drives containing residual data, users had previously attempted to wipe them clean by dragging files to the Recycle Bin or using the delete function. A quick format was performed on 40 percent of the used drives but data was still recoverable. Out of the 200 used HDDs and SSDs, only 10 percent had a secure erasure procedure performed on them.
"In even the most technology-inclined companies today, IT executives and CIOs often put most of their attention, resources and budgets towards tackling ‘scary’ data security threats, such as backdoor attacks, extortion hacks, malicious insider intrusions and malware," adds Blancco's CEO, Pat Clawson. "So investing in tools and methods to erase data from IT assets tends to sit low on their organization’s list of IT security priorities. But as our study shows, the dangers are just as precarious when data isn't securely and completely erased".
You can read more in the full study which is available from the Blancco Technology website.
Photo Credit: kubais/Shutterstock