It's not usually landfills which are the vector for this kind of leak, it's second-hand disk sales. This includes both decommed hardware and items scavenged fro

It's not usually landfills which are the vector for this kind of leak, it's second-hand disk sales. This includes both decommed hardware and items scavenged from failures: often the failure was transient, or in the chassis; the maintenance vendor will test and resell the disk if it passes. They are supposed to be wiped, but this takes a long time and is almost never verified so the process is often incomplete. Some such vendors have a blanket destruction policy for old hardware, but this obviously means higher prices, so it's usually only borne by medical and military institutions. And there have been notable cases where this was supposed to happen but the disks ended up on eBay, unwiped, regardless. SSDs make this even more likely because they have pools of storage which are screened off from normal access but are typically readable through special code in the firmware; as failing sectors are swapped out, sensitive plaintext can remain behind, unable to be wiped by a conventional dd-style blast. (HDDs have this too, but in much smaller quantities.)