I bought an old Apple Xserve on ebay. The seller was a used computer reseller, not the original owner of the server/data. The server's hard drives were wiped and had no OS on them, but they did have one odd named folder.
Turns out that folder contains all of the financial and HR data for a large 100-200 person company. It has EVERYTHING you could ever hope to NOT leak. Social security numbers, names, addresses, numbers, salaries, emergency contact info, even personnel photos. It even had the W-9's from their independent contractors. This hurt as I am an independent contractor and I've given my W-9s to many companies. Who knows how well those companies protect my data. (W-9's often have social security numbers on them)
All of the files had dates from 2012 and older. I bought the server/drive in early 2018. So for 6 years, who knows where this data was. But 2012 is when it came out of service. Also the Server was a 2009 Xserve but the drive carrier was from a G5 (2005) Xserve. Which means its fairly likely that this drive did not come with this server. Whether this switch was done at the company, or whether the reseller just grabbed boxes of drives and stuck them in whatever computers needed them, who knows.
I replaced the drives with new ones, which I was going to do anyway, and now the server is off in service for me. But the original drives are sitting on my desk. I still don't know what to do with them. I tried contacting the company twice but I never heard back.
If I do hear back, I suspect what they will do is either tell me to destroy them, or have me send them back to them and then they will destroy them... and do nothing else. What they SHOULD be doing is firing their 2012 IT department if any of them still work there, and notify all pre-2013 employees that their data has been breached.
I am certainly not trying to hold these drives hostage. That said, being completely honest, if they offered me a "reward" for returning it, I certainly would accept. But they won't even acknowledge this situation. I'm getting sick of looking at these drives on my desk. I was thinking of contacting them on facebook, since that's all the rage these days when it comes to getting a response from a company.
If there are security experts here, I'd love to hear what you think about this situation.
Also, just as a hypothetical, I am NOT going to do this. But I'm curious. Since I bought the drive, and since they aren't getting back to me, could I legally throw the drive back on ebay, and say the previous owner never erased it and it's filled with ~150GB of personal/professional data? And let sketchy people bid it up to some crazy amount of money. Again, I AM NOT GOING TO DO THIS, I'm just wondering if I could.
I'm not going to name the company publicly. But they are ironically, a "Branding" company that works with other very large companies. How funny is that :P