Myth Buster: "Our data is not valuable"

It is one of the most persistent sentences in cyber security: we are not a bank, a hospital or a technology company, so our data is not valuable. There is nothing here that a criminal would want.

The belief usually rests on a narrow idea of value. People imagine a criminal inspecting each file, deciding what it could fetch on a market and walking away if the price is low.

That is not how modern data crime works.

A criminal does not need your data to be valuable to somebody else. It may be enough that the data is valuable to you: valuable enough to recover, valuable enough to keep confidential, valuable enough to prove what happened, or valuable enough that your organisation cannot function without it.

That gives us the central point of this Myth Buster:

Data does not need a black-market price to have value. If its loss, corruption, disclosure or unavailability causes harm, it has value.

Chapter 1The wrong question

Asking whether an individual file is valuable to a criminal starts in the wrong place. It treats data as a commodity and ignores what the record does inside the organisation that created or holds it.

A customer list may be worth relatively little as a spreadsheet and still expose every commercial relationship the business has built. A set of engineering drawings may have no obvious retail buyer and still save a competitor years of work. A care record may never be sold and still give an extortionist leverage over a family. A clean identity directory may look administrative and still determine whether the organisation can recover at all.

The better questions are these:

• What decision, service or obligation depends on this information?
• What happens if it becomes public?
• What happens if it cannot be trusted?
• What happens if it is unavailable for a day, a week or a month?
• Can it genuinely be recreated, and how long would that take?

Those questions reveal forms of value that a resale price cannot measure.

Chapter 2The three values hidden in every important record

Important data normally carries at least one of three forms of value. Many records carry all three.

Value to the organisation. The record allows the business to trade, deliver a service, meet an obligation, understand a customer, prove ownership or recover after disruption. Its value is the work it enables and the cost of operating without it.

Value as leverage. The record may be sensitive, private, embarrassing, regulated or simply essential. An attacker can threaten to publish it, corrupt it or withhold access. The leverage comes from the harm the victim is trying to avoid, not from what the attacker could earn by selling the file.

Value in combination. A name may look harmless. So may a job title, an email address, a supplier invoice or a project calendar. Combined, those fragments can map relationships, identify decision makers, improve impersonation and make fraud more credible. Data that looks ordinary in isolation can become highly useful when joined to other records.

This is why a simple classification of 'confidential' and 'not confidential' is not enough. An organisation also needs to understand consequence, dependency and recoverability.

Chapter 3Criminal value is not the same as organisational value

Some stolen credentials have been offered for pennies. That fact does not prove the underlying data is worthless. It proves that criminal data markets can operate at industrial scale.

When international law enforcement disrupted Genesis Market in 2023, the marketplace held around 80 million sets of credentials linked to approximately two million victims. Entries were advertised from as little as 56 pence. The low unit price did not reduce the possible harm. The records included access to online banking, payment services and retail accounts, packaged with the digital fingerprints criminals could use to imitate victims and bypass fraud controls.

The price paid by the buyer and the cost borne by the victim are two different numbers.

The same distinction applies to an organisation. A stolen mailbox may cost an attacker very little to acquire. Once inside, it can reveal invoices, approval chains, legal matters, customer conversations and password-reset routes. The entry price is not a valuation of the business dependency behind it.

Chapter 4Your data can be valuable because it stops you working

Availability is value.

An appointment system, production schedule, case file, property record, source-code repository or account ledger does not have to contain spectacular secrets. It only has to be necessary on Monday morning.

The Information Commissioner's Office recorded the consequence of this at the London Borough of Hackney. A 2020 cyber attack encrypted and exfiltrated records relating to more than 280,000 people. Some council services were disrupted for many months, and the handling of freedom of information and subject access requests did not return to normal until 2022.

That is value expressed as lost capability rather than sale price.

IBM's 2024 Cost of a Data Breach study estimated the average UK breach cost at £3.58 million. That is a vendor-sponsored average and it should not be presented as the likely cost for every organisation. Its composition is more useful than the headline: lost business and the work required after the breach were major cost drivers. The financial damage sits around the data as much as inside it.

Sophos reached a similar conclusion in its 2025 survey of 201 UK organisations affected by ransomware. It reported an average recovery cost of $2.58 million before any ransom payment. This is vendor survey evidence rather than a national census, but the direction is clear. Rebuilding systems, investigating events and restoring operations can cost far more than the criminal market value of the records involved.

Chapter 5Your data can be valuable because it creates leverage

Ransomware used to be described primarily as an encryption problem. It is now an extortion problem.

The National Cyber Security Centre says organisations should assume that data has been stolen in a ransomware incident. Its 2024 guidance also warns that paying does not guarantee deletion. During the international disruption of LockBit, law enforcement found data belonging to victims who had paid the criminals and had been told it would be deleted.

This changes the attacker's calculation. They may encrypt the data, steal it, threaten to publish it, contact customers and employees, or combine those pressures. They do not need a willing buyer. They need the organisation to care about the outcome.

A board minute can create leverage because it records a disputed decision. A medical file can create leverage because it belongs to a real person. A contract can create leverage because disclosure could damage a negotiation. A recovery copy can create leverage because the organisation needs it to trade again.

The more consequential the loss is to the owner, the more useful the data can become to an extortionist.

Chapter 6Your data can be valuable because it identifies people

Data does not have to reveal a complete identity to contribute to fraud. Criminals assemble believable stories from partial records.

UK Finance recorded £1.17 billion stolen through unauthorised and authorised fraud during 2024, across 3.13 million confirmed cases of unauthorised fraud alone. The National Crime Agency estimates that 67 per cent of fraud reported in the UK is cyber-enabled.

A compromised supplier list helps an attacker choose the right organisation to impersonate. An invoice reveals amounts, payment dates and account details. A staff directory supplies names and authority. An email thread supplies tone and context. A calendar supplies timing. None of those records needs to be exceptional. Together they can make a fraudulent request appear routine.

This is aggregation risk: the value emerges from the relationship between records, not only from any one field.

Chapter 7Your data can be valuable because it proves something

Some information matters because it is evidence.

Signed agreements prove obligations. Audit records prove actions. Design histories prove how a product was made. Case notes prove what advice was given. Photographs and inspection records prove condition. Financial records support statutory reporting. Security logs help establish what happened during an incident.

The danger is not limited to deletion. If the integrity of those records is lost, the organisation may have the files but no longer be able to rely on them. A corrupted recovery copy, altered ledger or incomplete audit trail can be as damaging as an absent one because the burden shifts to proving what is true.

This is why preservation requires more than another live copy. The organisation needs a clean, dated and controlled version that remains outside the ordinary path of change.

Chapter 8Your data can be valuable because the law says it carries consequence

Personal data brings duties whether or not an attacker could sell it.

UK data protection rules require organisations to assess personal data breaches and, where the threshold is met, report them to the ICO without undue delay and where feasible within 72 hours. Where the breach is likely to create a high risk for people, those people must also be informed without undue delay.

That work requires facts: what was held, who was affected, what happened, what the likely consequences are and what has been done. An organisation that dismissed its records as low value before an incident may discover that it cannot answer those questions afterwards.

The obligation does not arise because a spreadsheet commanded a particular price. It arises because information about people can create harm when it is lost, altered or disclosed.

Chapter 9Your data can be valuable because it cannot be recreated

The sentence 'we can recreate it' deserves the same scrutiny as 'it is not valuable'.

Some data can be regenerated from a known source. Much of it cannot.

A final contract can be scanned again if the signed original still exists. A customer history cannot be recreated if years of correspondence have gone. A clinical observation cannot be repeated at the same moment. A design decision may not be recoverable from the finished drawing. A former employee's knowledge may no longer be available. A clean configuration from before an attack cannot be reconstructed by copying the compromised state.

Recreation also has a cost. People must stop productive work, locate sources, validate versions, resolve contradictions and rebuild confidence. If a record takes 30 minutes to reconstruct and 20,000 records are affected, 'recreatable' describes 10,000 hours of work before quality assurance.

The proper test is not whether recreation is theoretically possible. It is whether the organisation has measured the time, evidence and dependencies required to do it at scale.

Chapter 10Intellectual property is data too

The value discussion often focuses on personal information and misses the records that make one organisation different from another.

The NCSC and National Protective Security Authority warn that innovative organisations are attractive to state actors seeking technology, competitors seeking commercial advantage and criminals looking to profit from weak security. A joint international advisory on the North Korea-linked Andariel group describes the theft of technical information and intellectual property, including contract specifications and design drawings, across defence, aerospace, nuclear, engineering, medical and energy targets.

That is not abstract espionage language. It describes the commercial memory of an organisation: formulas, processes, code, drawings, research, bids, pricing, supplier intelligence and the reasoning behind decisions.

If another party can use it to shorten its development, strengthen its negotiation or understand your weaknesses, it has value.

Chapter 11Small does not mean uninteresting

Smaller organisations often believe they sit below the attention threshold. Automation removes much of that comfort.

Attackers can scan large numbers of organisations, test exposed services, reuse stolen passwords and send convincing fraudulent messages at very low marginal cost. They do not have to choose a small business because its data is uniquely desirable. They can compromise it because an opportunity appears, then discover what leverage exists afterwards.

The UK Government's Cyber Security Breaches Survey 2024 found that half of businesses identified a breach or attack in the preceding 12 months. The business population behind that survey is predominantly micro and small organisations. Large incidents receive headlines; routine compromise remains part of the same economy.

The relevant question is not 'why would they choose us?' It is 'what happens if an automated attack reaches us?'

Chapter 12What belongs in the protected set

The answer is not to put every file in Offline Secure Storage®.

Live transactional systems need to remain live. Frequently changing collaborative data belongs in platforms designed for that work. The protected set is the smaller body of information whose loss, corruption, exposure or extended unavailability would have disproportionate consequences.

That may include:

• clean recovery copies and the information needed to rebuild identity;
• signed contracts, deeds, licences and governance records;
• completed customer, patient, client or matter files that must be retained;
• intellectual property, released source code, designs and research;
• financial evidence, insurance material and statutory records;
• critical configurations, certificates, keys and recovery procedures;
• historical records that cannot be captured again.

This is a business exercise before it is a storage exercise. Technology teams can explain systems and dependencies. The people who own the consequences must decide what the organisation cannot afford to lose.

Chapter 13Where Offline Secure Storage changes the risk

Offline Secure Storage gives selected information a state that ordinary connected storage does not provide. When the instance is closed, the physical Layer 1 route to its dedicated hardware does not exist. An authorised out-of-band command creates a temporary access window, the customer works with the data, and the route is physically disconnected again.

The value is not that the files become impossible to use. The preceding Myth Buster, Offline Secure Storage means giving up access, explains why access and standing exposure are different things.

The value here is that records the organisation depends upon no longer have to share the same permanent attack path as the live estate. A compromised administrator, automated ransomware process or remote intruder cannot traverse a network route that is physically open.

That does not replace classification, encryption, identity security, tested recovery, retention policy or incident response. It creates a different final condition for the data with the greatest consequence.

Chapter 14Questions for the board

• Which information would stop us trading or delivering our service if it were unavailable for seven days?
• Which records would create the most leverage if an attacker threatened to publish them?
• Which evidence would we need to defend a claim, satisfy a regulator or understand an incident?
• Which intellectual property would save a competitor time or money?
• Which records cannot be recreated from another authoritative source?
• Do our clean recovery copies depend on the same identities, software and network paths as production?
• When did we last restore the complete protected set into a clean environment?
• Who owns the decision about what belongs in that set?

Chapter 15Frequently asked questions

We hold no payment card data. Are we still a target? Yes. Criminal value extends beyond card details. Email, identity, contracts, customer records, intellectual property and operational data can support fraud, extortion and further access. An attacker can also profit from interrupting the service the data supports.

Is personal data always more valuable than business data? No. Different information creates different consequences. Personal data can expose people and regulatory duties. Business data can carry intellectual property, legal evidence, operational dependency or negotiating leverage. The right comparison is consequence, not file type.

If we have backups, have we protected the value? Only if the backup is complete, clean, reachable when needed and outside the incident that damaged production. A connected backup may share identities, management tools and network paths with the systems it is meant to recover. At least one tested recovery copy should be isolated from that common route.

How do we identify the data that matters most? Start with business impact. Ask what the organisation must prove, protect, continue and recover. Map each dependency to an authoritative record, name its owner, define how current it must be and test restoration. The result should be a deliberately small protected set, not an indiscriminate copy of everything.

Chapter 16The conclusion

'Our data is not valuable' normally means one of two things: nobody has priced its loss, or nobody has followed the dependency far enough.

Data has value when it keeps a service running, when it proves an obligation, when it contains an advantage, when it protects a person, when it allows a clean recovery, or when its disclosure would cause harm. Criminals understand that value even when organisations do not. They turn it into access, fraud, interruption and leverage.

The task is not to declare every byte precious. It is to identify the information whose consequence is disproportionate and give it protection that reflects what the organisation would lose without it.

Your data does not need to be valuable to the world.

It only needs to be valuable to you.

Chapter 17Sources and further reading

• NCSC and NCA, Ransomware, extortion and the cyber crime ecosystem
• NCSC, What's happened to my data?
• National Crime Agency, Fraud and economic crime
• UK Finance, Annual Fraud Report 2025
• ICO, London Borough of Hackney reprimanded following cyber attack
• ICO, Personal data breaches: a guide
• UK Government, Cyber Security Breaches Survey 2024
• NCSC, Andariel cyber campaign advisory
• IBM, Cost of a Data Breach Report 2024: UK findings
• Sophos, State of Ransomware in the UK 2025
• Firevault, Offline Secure Storage
• Firevault, Get started