How your old cell phone can bring your company down

MUMBAI: That Blackberry that you had exchanged for your new iPhone 6 could not only leak most sensitive information about your company, it could also leak your private pictures. Worse, this could be done even when you have deleted all your data, or done "factory reset" on your devices, says a case study conducted by Ernst & Young, fraud investigation and dispute services.

The report says that many data thieves are specifically targeting particular type of devices, mainly used by top CEOs and executives, for retrieving and then selling or utilizing the data. EY’s fraud investigation & dispute services team conducted a data retrieval exercise on 25 devices, comprising 15 hard disks (of tablets and laptops) and 10 smart phones. "The objective was to evaluate the risks companies could potentially face due to improper disposal of enterprise storage devices and how forensic data recovery procedures are capable of retrieving confidential data that could compromise organizations," the EY report says.

The findings were shocking. The team was able to recover 248,747 documents from these devices. These documents included about 15,557 word documents, 22192 excel sheets, 11,942 pdf documents, and 31 e-mail files. "On 9% of the devices the data was deleted, from which the team could forensically recover 27% of the deleted data," the EY report says.

Industry trackers say that many data thieves can easily fish out the information from old devices. Worse, many owners of these devices did not even bother to delete the old passwords and documents. In one of the cases as soon as a new sim card was placed the new emails started popping up.

So what can be done about this. The best thing that you could do is never sell your old devices say experts. However to implement that may not be possible for all of the companies providing devices to their thousands of employees. "Ensure employees are made of proper policy and procedure to dispose such assets. In case of any doubt, ensure IT supports the end user in disposal, ensuring no corporate data can be retrieved," said a senior EY official.