A breach tied to stored personal data shows how old infrastructure can become a privacy liability long after teams stop thinking about it.