Data hoarding: The gift that keeps on giving (to hackers)

“Keep it just in case” may sound like a cautious approach to managing information. From a cybersecurity perspective, however, it can produce exactly the opposite result. 

For decades, organizations have accumulated vast amounts of information, often retaining it far longer than necessary. Storage was relatively inexpensive, employees prioritized convenience over information governance, and uncertainty about legal or regulatory requirements encouraged a “better safe than sorry” mentality. Add the fear of deleting something that might someday prove useful, and the result is a form of organizational data hoarding.

Individually, these retention decisions may seem harmless. Collectively, they create years, or even decades, of accumulated information scattered across shared drives, email, collaboration platforms, cloud environments, legacy systems, and forgotten repositories.

And every unnecessary piece of retained information represents potential exposure.

Cybersecurity isn't just about keeping attackers out

Organizations understandably devote significant resources to preventing unauthorized access through firewalls, access controls, encryption, monitoring, and other security measures. But cybersecurity should also address a second, equally important question: If an attacker does gain access, how much information could be exposed?

Consider two otherwise similar organizations that experience comparable security compromises.

• Organization A maintains three years of information that it legitimately needs for business, legal, or regulatory purposes.
• Organization B retains 15 years of information, including obsolete records, duplicate files, outdated exports, abandoned folders, and sensitive information with no continuing business or legal value.

The nature of the intrusion may be similar. The potential consequences are not. Organization B may face substantially greater exposure, including more compromised records, increased notification obligations, higher investigation and remediation costs, and potentially greater regulatory and litigation risk.

The information an organization no longer needs can still cause considerable harm when exposed.

Data proliferation multiplies the problem

The risk isn't limited to how long information is retained. It also depends on how widely that information is distributed. A sensitive record maintained in an appropriately secured system may be subject to well-defined access controls and oversight. But when copies of that same information accumulate in email attachments, employee downloads, collaboration platforms, shared drives, and archives, the number of locations requiring protection expands.

These duplicative copies may lack the security controls, visibility, and governance applied to the original information. The result is a larger attack surface and more information potentially available to an attacker.

This is where data minimization and information life cycle management become essential components of cybersecurity risk reduction, not merely records management or compliance exercises.

Defensible disposal starts with a retention schedule

Effective data minimization isn't about indiscriminate deletion. It's about retaining information for as long as necessary and disposing of it when there is no longer a legitimate reason to keep it.

A records retention schedule provides the foundation for defensible disposal by identifying information categories, establishing retention periods based on legal, regulatory, contractual, and business requirements, and defining when information becomes eligible for destruction.

Disposition must also account for litigation holds, investigations, and other preservation obligations that may override normal retention periods.

But a retention schedule alone doesn't reduce risk. Its value comes from consistent execution through documented procedures, clear accountability, and routine, secure disposal.

Routine disposition is a cybersecurity control

Organizations frequently focus on preventing breaches while overlooking one of the most practical ways to reduce their potential impact: routinely eliminating information they no longer need. A defensible disposition program translates retention requirements into recurring action. It identifies information that has reached the end of its required retention period, verifies that no holds or other obligations prevent disposal, and facilitates secure, documented destruction.

This process should extend beyond traditional records repositories to include redundant, obsolete, and trivial information, as well as unnecessary copies scattered throughout the organization's technology environment.

When disposition becomes a routine business practice rather than an occasional cleanup initiative, organizations can:

• Reduce the volume of sensitive information potentially exposed in a breach.
• Limit unnecessary duplication and proliferation across systems.
• Reduce the scope and complexity of breach investigations and response efforts.
• Improve visibility, governance, and control over retained information.
• Lower storage, discovery, and information management costs.

Perhaps most importantly, routine disposition reduces risk continuously, rather than waiting until an incident exposes the consequences of years of over-retention.

Where to start: Practical steps for organizations without a disposal program

Not every organization has a mature information governance or defensible disposition program. Fortunately, meaningful progress doesn't require tackling everything at once.

A few practical starting points:

• Establish or update a retention schedule: Work with Legal, Compliance, Records Management, IT, and business stakeholders to define retention requirements and identify information eligible for disposal.
• Identify data locations: Determine where information lives, particularly locations containing sensitive information or large volumes of older data.
• Prioritize data for disposal: Select a manageable repository or information category for a pilot project. Focus on older information, unnecessary duplicates, and repositories with limited business value.
• Make disposal repeatable and part of business as usual: Assign responsibility, document approvals and destruction activities, and establish recurring reviews. Where practical, use technology to automate retention and disposition. Incorporate disposal into existing workflows, system migrations, employee offboarding, and periodic information reviews rather than treating it as a one-time cleanup.

Keep in mind that the goal isn't immediate perfection. It's establishing a sustainable process that prevents unnecessary information from accumulating indefinitely.

The bottom line: What you don't keep can't be breached

No organization can eliminate cybersecurity risk entirely. Even well-protected systems can be compromised.

But organizations can make deliberate decisions about how much information they retain and, therefore, how much information may be at risk.

A defensible records retention and disposition program, supported by clear governance and consistently executed procedures, is more than a compliance obligation. It is a practical strategy for reducing the potential impact of a data breach.

Good cybersecurity isn't only about making information harder to access. It's also about making sure information that no longer needs to exist isn't there to be exposed in the first place.