Digital data and oil are not so different.

When the flow of data and oil goes properly, it is hidden from sight, fluid and goes unnoticed. But when there is a leak, the consequences are catastrophic. Suddenly, everything is laid to bare, whether it is our passwords, SIN numbers and birth dates or gallons of crude oil. Leaks are incredibly expensive and nearly impossible to clean, the contents become painfully public and have long-lasting effects on the surrounding environment.

If the risks for digital data exposure are so high and the consequences so severe, why do companies and organizations keep our toxic information at the ready? According to IBM, 4 billion data records were leaked last year. IBM estimates the average cost of a leaked record to be $154. That means more than $600 BILLION worth of leaked records in 2016 alone. And that figure is likely to only increase each year, as companies collect and store ever greater piles of records on their customers to inform business decisions.

Clearly, the way organizations understand, handle and protect data has to change. The large databases of our saved personal data have become dangerous liabilities for both business and consumers. Is it really worth the risk to keep storing this vulnerable information unless there is a very specific reason to do so? Companies need to evaluate what they store and for how long, and purge data that they don’t need that could become toxic if a leak or breach occurred.

Companies like Yahoo!, Ashley Madison, Sony and countless others have all seen just how toxic data that serves little purpose can be when exposed via a malicious hack. The impact to their businesses alone, from a reputation and trust perspective, is nearly incalculable. But for their customers who had personal information leaked – many of which may not have been active for some time – threats like fraud, public embarrassment, even blackmail all become very real concerns.

So what should companies do?  A few pieces of advice:

• Audit what customer information you store, and why. Create tiers of data importance that clearly shows what is vital to collect and store, what is important to collect and store, and what is of little importance to collect and score. You may be surprised by how much of the information you currently have falls into the third category versus the first two.
• Determine the risk of each individual tier should that information be leaked or breached in part or in full.
• Purge any information that is of little value to collect and store and carries high risk if exposed. The value of holding this information will never outweigh the risk of losing it.
• Evaluate new ways of authenticating a customer than collecting a mountain of new data which needs to be stored. If all you require to provide a service is name and city, only collect name and city (instead of also asking for address, date of birth, height, middle-school GPA and the countless other attributes that are often asked for little to no purpose)
• Assess carefully for how long you have to keep the data if at all.   Better to ask for the data again whenever necessary than storing it and be at risk to lose it.
• ENCRYPT ENCRYPT ENCRYPT. Encrypt data at rest and data in motion. Hash passwords to make them nearly impossible to crack. The tools to protect customer data are available, and are constantly evolving to counteract even the latest threats. 2016 alone proved there are 616 billion reasons to invest in proper protection of your data.