IIRC one data breach method back in the old days was "employee leaves backup tape someplace". Encryption-at-rest does a good job in that scenario. Beyond that,

IIRC one data breach method back in the old days was "employee leaves backup tape someplace". Encryption-at-rest does a good job in that scenario. Beyond that, seems like most of the physical-access compromises still involve at least some interaction with the software - so they would (in principle) leave traces and/or be detected by IDS. Walking up to a server and physically removing a hot-swap drive doesn't, so encryption at rest ensures that that attack won't work.