---
title: Tip: hunt down sensitive data you no longer need, like ID scans kept 'just in case' and card data left in old logs after moving to a payment processor | ctxsec
url: https://ctxsec.com/items/tip-purge-legacy-sensitive-data
description: ""
status: "tip (based on Park24 and Adventure disclosures)"
published: 2026-10-18
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-purge-legacy-sensitive-data.md)

tip (based on Park24 and Adventure disclosures)

2026-10-18

### Tip: hunt down sensitive data you no longer need, like ID scans kept 'just in case' and card data left in old logs after moving to a payment processor

Two Japanese breaches this month show the same gap. Times Car kept 1.6 million ID-document images for years after members left, and skyticket leaked cards from a 2018 log it missed when it moved card storage to a payment processor. Check three things. First, after KYC or ID checks, keep the verification result and delete the image, or set a short retention period you actually enforce. Second, after any migration of payments or secrets, search logs, audit or change-history tables, backups and old exports for PANs and credentials, for example with a PAN regex plus Luhn check across log stores and database dumps. Third, keep encryption keys apart from the data they protect, because in both the skyticket and SourceNext cases attackers took the keys along with the encrypted data.

Sources: [Park24 notice (Oct 16)](https://www.park24.co.jp/news/2026/10/20261016-1.html) · [Adventure Inc. timely disclosure (PDF, Oct 16)](https://contents.xj-storage.jp/xcontents/AS80678/06987693/2c29/4292/b580/6865f8440e38/140120261016552377.pdf)