I have encountered a situation where payment card (debit/credit) information, including name, number, expiration date, and cvc, is being saved by an organization unencrypted in excel spreadsheets on shared drives. The files are several years old and per the expiration date all the cards recorded have been expired. The obvious solution to the problem is to delete the information unless a very good reason exists to keep.
My question is, what is the risk exposure for unencrypted information for expired payment cards. I am not looking for details on how to carry out a fraud. I am seeking general information on whether the data can still be exploited for a fraud and if so what are some general ways. I am asking so that I can properly assess risk in an area I don't have experience in and so I can educate my clients on any dangers so they can appreciate the need to identify all the instances and address the problem.