Blancco Report Finds Stolen Devices are a Bigger Cause of Data Loss Than Stolen Credentials or Ransomware

Survey of IT leaders finds that AI and regulations are driving change in data disposition—leading to an average increase of 46% in compliance investment

BOSTON and LONDON – June 4, 2025— Blancco Technology Group, the industry standard in data erasure and mobile lifecycle solutions, today released new research into how regulations, AI, and environmental, social and governance goals are changing enterprise data disposition. Among key findings, the report shows that stolen drives and devices are a more common method of data loss than either ransomware or stolen credentials.

The Blancco 2025 State of Data Sanitization Report is based on the responses of 2,000 cybersecurity, IT and sustainability leaders from North America, Europe, and APAC. It unpacks how some of the world’s largest organizations are navigating end-of-life data management amid changing regulations, environmental targets, security strategies and AI adoption.

AI expands the threat footprint but enhances data management capabilities

The report found that in the last three years, 86% of enterprises have experienced a data breach and 73% of enterprises experienced a data leak. The most common ways to lose data were through phishing-related data breaches according to 54%, followed by improper network configuration (46%), and stolen devices or drives with sensitive data (41%). By comparison, data breaches due to weak and stolen credentials were reported by only 36%, and ransomware by just 32%.

With this risk, businesses should limit the amount of data they hold but advances in technology make this difficult. A quarter of respondents report that AI has increased the amount of redundant data they hold, and just over a fifth said that AI is making compliance more difficult. However, many claim AI is actually helping with data management, with more than 50% using it to help clearly define data retention and sanitization.

Compliance complexities drive increased investment

The landscape of data protection and privacy regulations, cybersecurity frameworks, and data destruction best practice standards is complex with updated standards, national and supra-national regulations, and industry-specific demands. To help meet this compliance burden, more than half of businesses are increasing their investment in this area, and the average increase in investment is 46%. Many businesses (55%) have policies in place when it comes to data disposition, and almost all of the remainder (42%) are rolling out or defining these policies.

The desire to meet these obligations results in unnecessary e-waste, with functional devices and drives destroyed to protect any sensitive data stored. Depending on the type of device, respondents claim that up to 47% of devices destroyed for data security reasons are still functional and 25% of laptops and desktops, and 19% of data center assets, are refurbished without certified erasure—increasing the potential for data loss. In fact, for 17% of the respondents that had experienced a breach or leak, data compromise was caused by redeployed devices or drives that still had sensitive data from prior use.

Most of the survey respondents claim that environmental goals remain as important as ever. In fact, 90% said that sustainability has at least a moderate impact on data disposal, and 77% agree that IT and sustainability teams are working closely on data management and the data erasure tools to meet sustainability goals.

“Improper data disposal is a hidden risk—and it’s not talked about enough. Every business IT leader needs to understand its responsibilities, seek out the best practices that maintain compliance with data privacy regulations, and secure data at the finish line. Our State of Data Sanitization Report acknowledges what organizations are dealing with now, then gives compliance, IT, and ESG teams insight into how those issues affect their approach to end-of-life data and asset disposition. Many large businesses get it, though our report confirms there is still work to do to meet today’s data protection obligations.”

Lou DiFruscio, CEO of Blancco

Other notable findings include:

• 83% of enterprises have deployed some form of AI. Of these respondents, 98% have upgraded endpoint devices to meet AI demands, upgrading an average 25% of devices.
• 97% of enterprises who have deployed AI have also upgraded data center assets to address AI deployment needs.
• 47% of data center assets are still functional at the time of destruction.
• Only 37% of enterprises said they were aware of NIST 800-88, the industry standard for data sanitization since 2014. Just 36% were aware of IEEE 2883-2022, the most recent standard for modern technologies, including those needed for AI processing and deployment. This lack of awareness may lead to policies that dictate sub-par data destruction methods at data and asset end-of-life.

The Blancco 2025 State of Data Sanitization Report is available to download here.

Notes to Editors:

Blancco commissioned independent research agency Coleman Parkes to survey 2,000 cybersecurity, IT and sustainability leaders at large enterprises of over 5,000 employees and within various sectors. Respondents were split between North America (U.S.), Europe (UK, France, and Germany) and APAC (Japan, Singapore, India, and Australia). Fieldwork took place in February and March 2025.

About Blancco Technology Group

Reduce Risk. Increase Efficiency. Be Sustainable. Blancco Technology Group provides organizations with secure, compliant, and automated solutions that accelerate the transition to the circular economy. Each year, tens of millions of Blancco erasures allow top-tier organizations to protect end-of-life data against unauthorized access, safely redeploy data storage assets, and firmly comply with increased data protection and privacy requirements. Our precise device diagnostics help move used IT assets confidently into the circular economy, enabling enterprises, IT asset disposition (ITAD) vendors and recyclers, and mobile industry stakeholders to operate more sustainably.

Globally approved, recommended, and certified by governing and industry bodies around the world, Blancco is the industry standard in data erasure and mobile lifecycle solutions. With 40+ patented or patent-pending ideas, we continue to grow the number of innovative solutions global companies can rely on to accelerate operations, secure their data, and grow their businesses. Read more about us at www.blancco.com.

Media Contacts

CCGroup for Blancco Technology Group: [email protected]