‘We don’t have a security problem anymore. We have a data problem now’