You Are Retiring Old Servers. Is Your Data Leaving With Them?

A deadline that will empty a lot of server closets

Microsoft lists January 2027 as the end of extended support for Windows Server 2016. Plenty of Oklahoma offices still run it. Some will move to the cloud. Others will buy new servers. Either way, a lot of old machines are about to be unplugged.

Those machines held years of work. Customer records, payroll files, database backups and old copies of reports nobody remembers making. When the server leaves the building, all of that can leave with it.

What the evidence says

In 2016 Blancco Technology Group bought 200 used hard drives and solid state drives from eBay and Craigslist in the United States. It found personal information on 67 percent of them. Eleven percent held company data such as email, customer records and sales spreadsheets. Only 10 percent had been securely erased.

The same study found that on 36 percent of the drives with leftover data, someone had tried to clean them by deleting files or emptying the recycle bin. On 40 percent, someone had run a quick format. In both cases the data could still be recovered.

A second Blancco study in 2019 looked at 159 used drives bought on eBay in four countries. Sensitive data was still on 42 percent of them. Every seller in that study said the drives had been wiped.

Large firms get this wrong too. In 2022 the Securities and Exchange Commission fined Morgan Stanley Smith Barney $35 million. The SEC said the firm hired a moving company with no data destruction experience to take apart thousands of old hard drives and servers. Some of those devices were later sold online with customer data still on them. The SEC also said 42 servers that may have held unencrypted customer data went missing during a hardware refresh.

A breach is expensive no matter how it starts. IBM's Cost of a Data Breach Report 2026 puts the average breach in the United States at $11.5 million. Customer personal information was the most common data stolen, at 52 percent of breaches, and cost $192 per record on average.

Why old drives still hold your data

Delete only hides the file

When you delete a file or format a drive, the computer marks the space as free. The data stays there until something writes over it. Free recovery tools can often bring it back in minutes.

Nobody has a list of the drives

Servers get extra drives over the years. Backups land on spare disks. Old laptops sit in a drawer. If no one keeps a list, no one can prove each drive was cleaned before it left.

The hauler is trusted by default

Many firms hand old gear to a recycler or a mover and assume the job is done. The Morgan Stanley case shows what happens when no one checks what the vendor actually did with it.

How to retire a server without losing control of the data

1. 1List every server, laptop, backup disk and USB drive you plan to retire, with its serial number.
2. 2Copy the data you still need to the new system and check that the copy opens and works.
3. 3Decide which data you must keep by law and which you no longer need at all.
4. 4Erase each drive using a method from NIST SP 800 88, the federal guide on media sanitization, or have it physically destroyed.
5. 5Record what was done to each drive, by whom and on what date. NIST includes a sample certificate of sanitization you can copy.
6. 6If a vendor does the work, get a written certificate for every drive and check a few yourself.
7. 7Turn on encryption for the new servers and laptops now, so the next refresh is easier and safer.

The Federal Trade Commission gives the same advice in plain words. Know what personal information you have. Keep only what you need. Dispose of the rest properly. Its business guide notes that data no longer in your system cannot be stolen by hackers.

What this means if you run a company in Oklahoma

Many Oklahoma firms run their databases and file shares on a few servers in their own building. In the IBM 2026 report, 30 percent of breaches involved data stored on premises, a bigger share than any other storage location. A hardware refresh is the moment that data is most likely to slip away unnoticed.

It is also a good moment to clean house. Moving data to a new system is the right time to drop old tables, old exports and old backups you no longer need.

At Oklahoma Data Partners, we help Oklahoma companies plan server and database moves, copy and check the data that matters, clear out what no longer belongs and leave a clean record of what was retired. If you are replacing servers in the next few months, book a consultation.