The Shadow Data You Don't Know You Have: A Practical Discovery Checklist

Every enterprise has a data inventory. Almost none of them are complete.

In February 2022, a UK Ministry of Defence official emailed a spreadsheet meant to hold around 150 records. Data hidden from the casual viewer meant it actually carried the details of more than 18,500 Afghans who had applied to UK relocation schemes. The government estimates the resulting resettlement scheme, kept secret until July 2025, will cost around £850 million, and in July 2026 Parliament's Defence Committee called the leak a "foreseeable systemic failure."

Nobody set out to create that copy of the data. That's what makes shadow data dangerous.

Somewhere between the systems your team knows about and the systems actually holding sensitive data sits a gap, and that gap has a name: shadow data.

We've covered what shadow data is and why it matters, but this article skips the definition and goes straight to the practical question security and IT teams actually need answered: where is it, and how do you find it before an auditor, a breach, or a regulator does?

Six Places Shadow Data Hides

Shadow data rarely shows up in one dramatic location. It accumulates quietly, one export or copy at a time, in places that were never meant to hold production data long term.

1. Test and Development Environments

Full production database copies get pulled into staging and dev for realistic testing, then never cleaned up. See our guide on test data management for how this happens and what to do about it. In June 2025, researchers got into McDonald's AI hiring platform through a Paradox.ai test account with the password "123456," leaving more than 64 million job applications open to access. Paradox said the account had not been logged into since 2019 and "should have been decommissioned."

2. Backup and Disaster Recovery Snapshots

Backups are built for recovery speed, not access control. A snapshot taken two years ago can still contain customer records that were deleted from production long since. In September 2025, attackers accessed SonicWall's cloud backup service. The company first said fewer than 5% of its firewalls were affected. Three weeks later it confirmed that every firewall backed up to the service had its configuration files taken, including encrypted credentials.

3. Spreadsheet and CSV Exports

Someone pulls a report for a board deck or a one off analysis, saves it to a laptop or a shared drive, and it outlives the reason it was created. That's exactly how the MoD leak happened: the hidden rows went out with the file. The Defence Committee found the department was running high risk casework on ad hoc Excel spreadsheets on SharePoint.

4. SaaS and Collaboration Tool Sprawl

Customer lists synced into a marketing platform, support tickets with attached ID documents, files dropped into a chat tool. Each connected app is a new place sensitive data can land unmonitored. Our piece on data sprawl covers this pattern at the infrastructure level. In August 2025, attackers used stolen OAuth tokens from the Salesloft Drift integration to pull data out of many companies' Salesforce instances. They then searched the support cases for AWS keys, passwords, and Snowflake tokens people had pasted in. In September 2025, attackers compromised Discord's outsourced customer support operation and exposed roughly 70,000 government ID photos users had submitted in age related appeals. (Discord identified the vendor as 5CA, which denies its own systems were breached.)

5. Decommissioned and Legacy Systems

Applications get replaced, but the databases behind them often don't get decommissioned with the same rigor. This is especially common around mainframe extracts and batch jobs that quietly write sensitive fields to intermediate files. In July 2025, the Tea dating safety app leaked 72,000 images, including about 13,000 verification selfies and photo IDs, from what it called a "legacy data storage system." Its privacy policy had said verification selfies would be "deleted immediately following the completion of the verification process."

6. M&A and Shared Drive Archives

Acquired companies bring their own undocumented data stores, and shared drives accumulate old exports from projects that wrapped up years ago. In March 2026, identity protection company Aura disclosed that a phone phishing attack on a single employee exposed about 900,000 records from a marketing database it had inherited when it acquired Circle Media Labs in 2021.

Why This is Worth Fixing Now

None of these sources look like a security incident on their own.

Together, they are a compliance and breach liability that most organizations can't quantify because they can't see it.

IBM's 2024 Cost of a Data Breach Report, the most recent edition to break out shadow data, found that 35% of breaches involved it. Those breaches averaged $5.27 million and took 291 days to identify and contain: 26.2% longer to identify and 20.2% longer to contain.

As we've covered in what shadow data is, forensics teams routinely uncover unmonitored copies across test servers, backups and retired applications, and those residual datasets complicate containment and inflate recovery costs.

Regulators don't grade on effort. PCI DSS explicitly requires you to confirm every location of stored card data at least annually, and GDPR and HIPAA reach the same place through records of processing and risk analysis. None of them accepts where the data is supposed to live.

A test database holding cleartext card numbers is a PCI DSS finding whether anyone remembers it exists or not: live PANs are not permitted in preproduction unless that environment is inside the CDE and meets every applicable requirement, and stored PAN must be rendered unreadable wherever it sits.

A Practical Discovery Checklist

Before you can protect shadow data, you have to find it. Start with these steps:

1. Inventory every environment that can hold a copy of production data, including staging, QA, sandbox, and analytics sandboxes, plus every test or service account that can reach them.
2. Pull a list of every SaaS application with an active data connector or export job, not just the ones IT provisioned directly. Include OAuth tokens and third-party integrations, which is how the Drift attackers got in.
3. Check backup retention policies against your actual regulatory retention requirements. Longer isn't safer.
4. Run content aware scanning across file shares and cloud storage rather than relying on folder names or file types to flag risk.
5. Include recently decommissioned systems and any mainframe batch or extract jobs in the scope, not just live applications.
6. Document what you find and classify it by sensitivity before deciding how to remediate it. Our guides on data discovery and data classification walk through both steps in more depth.

From Discovery to Protection

Finding shadow data is step one. The harder problem is making sure it doesn't come back, and that means shifting from perimeter and infrastructure monitoring to a data-centric security model, where protection travels with the data itself rather than depending on which system happens to be holding it.

In practice, that means applying tokenization or encryption at the point sensitive data is created or ingested, so every downstream copy, whether it's a test environment, a backup, or a spreadsheet export, is protected by default instead of by exception.

The cost of "by exception" is real. The SEC fined Morgan Stanley $35 million after decommissioned drives holding unencrypted data on about 15 million customers ended up for sale online. The firm also had encryption available on missing servers but hadn't turned it on for years.

DataStealth's data discovery and classification capabilities are built specifically to surface this kind of hidden data across structured and unstructured repositories, then hand it directly to tokenization and masking so it's remediated, not just reported on.

Shadow data isn't a one time cleanup project. It's an ongoing byproduct of how modern enterprises operate, and it needs ongoing control, not a periodic audit.

Want to see where your own shadow data is likely hiding? Book a demo with our team and we'll walk through how DataStealth finds it automatically and protects it on the same platform.