Legacy data is information retained from older systems, applications, or archives. It may include records created decades ago and carried through system migrations, even when the original software is no longer in use. The data can remain sensitive long after it stops being part of everyday operations.
In cyber security, legacy data can be harder to protect because its location, format, ownership, and access permissions may be poorly documented or governed by outdated controls. Attackers who gain access to an archive or neglected system may exfiltrate old records alongside current data. Defenders should inventory historical holdings, restrict access, encrypt them, monitor access, and apply retention and secure deletion policies. These measures also help incident responders determine what information may have been exposed.