“You want to make sure, first and foremost, [the data] didn’t come from you [and] you don’t have an active threat or compromise,” Boyd said. “You should assume that it’s probably [in] lots of places already, lots of organizations already have it.”