It would be easy to assume that data breaches primarily result from cyberattacks — phishing, malware, exploited vulnerabilities in live systems. In reality, a meaningful proportion of serious data breaches originate from something far less technically sophisticated: IT equipment disposed of without proper data sanitisation, later found by researchers, journalists, or opportunistic buyers with recoverable personal or commercial data still present.
Investigations into second-hand equipment markets have repeatedly found drives, and occasionally whole devices, containing recoverable data ranging from personal customer records to internal business documents and, in some documented cases, sensitive information such as financial records or health data. These findings are not isolated anomalies — they recur with enough regularity that data recovery from improperly wiped second-hand storage media has become a recognised area of security research in its own right.
The regulatory consequences of this kind of breach can be significant. The Information Commissioner’s Office has taken enforcement action, including financial penalties, against organisations whose data was found on inadequately sanitised equipment that had entered the second-hand market, in cases where the organisation had failed to verify that a third-party disposal contractor had actually carried out the sanitisation it claimed to. This underscores a point worth repeating: the accountability for a data breach arising from improper disposal generally sits with the organisation that generated the data, not solely with whichever contractor physically handled the equipment.
Beyond direct regulatory penalties, the reputational cost of this kind of breach can be disproportionate to the apparent scale of the underlying failure. A breach caused by a sophisticated cyberattack is, to some extent, understood by customers and the public as an unfortunate but not entirely preventable risk of modern business. A breach caused by a laptop sold on a public marketplace with customer data still recoverable on it tends to be perceived, not unreasonably, as a basic and avoidable failure of process, which can generate disproportionate reputational damage relative to the volume of data actually exposed.
The mitigations for this risk are, fortunately, well understood and not especially costly to implement: use a disposal provider that sanitises to a recognised standard such as NIST 800-88, insist on verified, per-device certificates of erasure rather than accepting generic assurances, and periodically audit or spot-check your provider’s process rather than treating a single initial due diligence exercise as sufficient indefinitely.
The uncomfortable reality is that this category of breach is entirely preventable with a properly managed disposal process, which makes it, from a risk management perspective, one of the more frustrating types of incident for an organisation to experience — not because it was unforeseeable, but precisely because it was.