Is data the new gold? Or the new poison?
We just keep saying it: data is the new gold.
Everyone wants to work in a “data-driven” way, and CRM systems make that even easier. In fact, they’re designed to store as much data as possible and create a “360° view of the customer.” In theory, this is wonderful because it allows you to help customers faster, understand them better, and engage with them in a more relevant way.
However, the recent Odido hack shows just how quickly things can go wrong if you ignore the other side of the story.
Not that employee. But what was in the CRM.
At Odido, hackers used social engineering to gain access to a service desk employee’s account. No technical wizardry involved—just cleverly tricking someone.
Once they were inside, they found a CRM system filled with millions of customer records, including name and address information linked to passport numbers. These records included not only current customers but also people who hadn’t been customers for years.
Why was that data still there in the first place?
We can point to training, awareness, and “human error,” but that’s too easy. The real problem lies in data retention.
We collect too much.
We keep things for too long and delete too little.
- Data is saved “for later”
- CRM fields are never cleaned up
- Copies of identification documents end up in files and are never lost
- Retention periods exist only on paper
And making employees responsible for data management? That’s an illusion. Not because people are stupid. But because this is simply not a task that suits humans. The mountain of data is far too large for that.
Without information management!
Odido had passport numbers on file that, according to their own policy, should have been deleted long ago. That pretty much says it all. The policy was in place. But the technology to enforce it was completely lacking. And CRM systems? They’re fantastic at storing data but terrible at deleting it.
The infamous example: passport copies
Everyone is familiar with this scenario:
- You sign up for a subscription.
- A copy of your ID will be made.
- That document will be added to the CRM.
- And that's where it ends.
Until someone finds it who shouldn't. This is exactly the kind of process you should never leave to employees or the CRM. You need to automate this with an information management solution.
This is not a new policy
The solution lies in technology. A modern information management system ensures that:
- retention periods are automatically enforced
- old data is automatically deleted
- employees can no longer leave local copies or passport scans lying around
- You should only keep what you actually use or are allowed to use
That is exactly why I view information management as a prerequisite for security, not as an “extra layer” on top of your tools.
Without that foundation, every organization remains a data time bomb that will go off sooner or later.