This highlights an important aspect of Data Security that is often never talked about Data Minimization. It seems they had a old copy of the database, likely

This highlights an important aspect of Data Security that is often never talked about Data Minimization. It seems they had a old copy of the database, likely a backup, just sitting around somewhere. The question is why did this old copy, from 4 years ago, still exist. Why was it not deleted under a standard data retention policy. Companies not only need to spend time on how they will secure data, they need to spend time on how they will age out and delete old data.