When a server leaves the rack, it leaves the asset register. The data on it does not leave with it.
That gap is how Morgan Stanley ended up paying a $35 million SEC penalty in 2022. After decommissioning two data centres in 2016, the firm handed thousands of devices to a moving company with no data destruction experience. Around 1,000 unencrypted hard drives and 8,000 backup tapes ended up resold on auction sites, and the customer data of roughly 15 million people was exposed. The firm had already paid a $60 million penalty to the US Office of the Comptroller of the Currency over the same decommissioning in 2020. The problem was discovered only because an IT professional in Oklahoma bought some of the drives and found the bank's customer data still on them.
Nothing about that incident involved a sophisticated attacker. It was a hardware disposal project that nobody in security owned.
Most organisations sell or dispose of IT equipment in bulk at some point: during a hardware refresh, a data centre exit, a cloud migration, an office closure or a merger. These projects are usually run by IT operations or procurement, measured on cost recovery, and finished as quickly as possible. This guide treats them as what they really are: a data security process with a third party at the centre of it.
Deleting files or reformatting a drive removes the pointers to the data, not the data itself. As CISA notes, deleted data can often be recovered with freely available tools. Solid-state drives add another problem: they spread writes across spare memory blocks that ordinary overwrite tools cannot reach, so a "wiped" SSD can still hold readable fragments.
A bulk lot rarely contains only laptops and servers. Security teams should flag every device that can store information, including:
The same SEC case found that 42 of 500 decommissioned network caching devices could not be accounted for after their supposed disposal. If you cannot show where a data-bearing device went, you cannot show that the data on it was protected. For a regulator, that looks very similar to a breach.
Secure disposal is not optional good practice. It appears in most of the frameworks your organisation is likely to be assessed against.
The common thread is accountability. You can hand the hardware to someone else. You cannot hand them the responsibility for what was on it.
The steps below fit most refresh or decommissioning projects, whether the lot is 50 laptops or several racks of servers.
Start from your IT asset register, not from what is physically sitting in the storeroom. List each item by make, model and serial number, and record the serial numbers of the drives inside servers and storage arrays, not just the chassis. Reconcile the list against what is actually present. Any device that is on the register but missing should be investigated before the sale goes ahead, not after.
Not every device needs the same treatment. Map each device to the most sensitive data it could have held, then pick the NIST 800-88 level that fits:
This choice has a direct effect on value. A drive that has been purged and verified can be resold. A shredded drive cannot.
Sanitising storage does not remove every link back to your organisation. Before equipment leaves your control:
Use erasure tools that produce a record for each drive, including the serial number, method used, date, operator and result. Then check the results. NIST's revised guidance distinguishes between verifying that a sanitisation tool ran correctly and validating that data is actually unrecoverable, and many organisations sample a percentage of erased drives for forensic checks. Any drive that fails erasure should move to physical destruction, never to the resale pile.
Every handover of equipment is a point where devices can go missing. Use sealed, numbered containers, record who handed over what and when, and get a signature at each stage. Agree in writing whether your buyer may use subcontractors. Morgan Stanley's problem began when its contractor passed devices to another firm without the bank knowing. If your data is highly sensitive, ask for on-site sanitisation or destruction so that drives never leave your premises with data on them.
At the end of the project, you should receive a certificate of sanitisation or destruction that lists every device by serial number. Match it line by line against your disposal inventory from step 1. A missing serial number is not an admin issue. Treat it as a potential data loss and investigate it through your incident process.
Many organisations run detailed security assessments on software vendors and then hand pallets of data-bearing hardware to a buyer chosen mainly on price. The buyer deserves the same third-party risk review as any supplier that handles your data.
Selling used IT equipment in bulk to a specialist IT asset disposition (ITAD) buyer, rather than splitting lots across general online marketplaces, makes this review practical: you assess one supplier, get one chain of custody and receive one set of certificates. Whichever route you choose, ask the buyer these questions before you sign:
A buyer that can answer these clearly is usually also the one that will offer a fair price, because well-documented, properly sanitised equipment is easier for them to resell.
Security controls are often seen as a cost on top of a disposal project. In bulk equipment sales they tend to increase the return:
There is an environmental side as well. The Global E-waste Monitor 2024 estimated that the world generated 62 million tonnes of e-waste in 2022, and reuse keeps working hardware out of that figure. For organisations with sustainability reporting commitments, a documented resale and reuse programme supports those disclosures too.
Even a well-run process can fail. A courier van is stolen. A certificate is missing a serial number. A security researcher emails to say they bought one of your drives online and it still has data on it.
Most incident response plans focus on attacks against live systems and say nothing about these scenarios. Close that gap:
Bulk equipment sales sit in an awkward place: they are run as an operational or financial task, but the main risk they carry is a data security risk. Organisations that close that gap do a few things consistently. They start from an accurate inventory, match sanitisation to data sensitivity, strip every link back to the organisation, keep an unbroken chain of custody, reconcile certificates line by line, and assess their buyer like any other third party that handles their data.
Done this way, retiring hardware stops being an unmonitored exit point for data. It becomes a documented, auditable process that recovers value, supports compliance evidence and stands up to scrutiny if something goes wrong.