67% of Used HDDs/SSDs Sold on eBay and Craigslist Hold Personally Identifiable Information – Blancco

E-commerce sites are reselling used electronics without permanently erasing data from them, according to The Leftovers: A Data Recovery Study released by Blancco Technology Group.

Based on an analysis of 200 second-hand HDD drives and SSDs purchased from eBay and Craigslist in the first quarter of 2016, 67% of the used drives contained personally identifiable information and 11% held sensitive corporate data, including company emails, CRM records and spreadsheets containing sales projections and product inventories.

Which types of personally identifiable information were recovered from drives?


The study’s findings reiterate how easy, common and dangerous it is when businesses buy back and/or resell used electronics without properly wiping all data from them. Whether the business is a traditional brick-and-mortar retailer, an e-commerce site, an electronics manufacturer or an enterprise business, failing to wipe drives clean before they are resold, repurposed or recycled can cause irreparable damage to customer loyalty, brand reputation and sales, both near-term and long-term.

Recent examples of data breaches and backlash resulting from this mistake reiterate how important it is to improve this area of data security.

As Paul Henry, IT security consultant for Blancco Technology Group, explains: “With the Ashley Madison hack, in particular, users who wanted to make sure all of their data was erased from the dating site put all of their trust into the site’s $20 ‘Full Delete’ program. Even though the obvious identifiers had been removed, enough information was left to expose the site’s users. The big lesson for Ashley Madison – and any other type of business – should be to test that your deletion methods are adequate and to not blindly trust that simply ‘deleting’ data will truly get rid of all of it for good. Remaining data can still be accessed and recovered unless the data is securely and permanently erased.”

Key findings from the study include:

• Company emails, CRM records and spreadsheets are highly susceptible to leaks. Our digital forensics experts found company emails on 9% of the drives, followed by spreadsheets containing sales projections and product inventories (5%) and CRM records (1%).
• Delete doesn’t always mean delete. On 36% of the used HDDs/SSDs containing residual data, users previously attempted to wipe the drives clean by dragging files to the ‘Recycle Bin’ or using the ‘delete’ button.
• Quick formatted data can still be recoverable. A quick format was performed on nearly half (40%) of the used drives with lingering data found on them.
• Despite proven capabilities, data erasure is still the lesser-known unicorn. Out of the 200 used HDDs and SSDs, only 10% had a secure data erasure method performed on them.

For Blancco Technology Group CEO, Pat Clawson, these findings are not surprising: “In even the most technology-inclined companies today, IT executives and CIOs often put most of their attention, resources and budgets towards tackling ‘scary’ data security threats, such as backdoor attacks, extortion hacks, malicious insider intrusions and malware. So investing in tools and methods to erase data from IT assets tends to sit low on their organization’s list of IT security priorities. But as our study shows, the dangers are just as precarious when data isn’t securely and completely erased.”