To determine whether users securely delete data before selling or giving away their hard disks, Windows system tools maker O&O bought 100 used disks and other "data carriers" from eBay to see if data was present and restorable.

Only 10 percent of the disks had been properly wiped, the company says. The others contained private data ranging from scanned signatures and ID cards to legal powers of attorney, account access information, and PIN and access code lists.

Particularly disturbing was the number of files found on hard disks from companies. For example, the study lists retrieved data such as reports on turnover and market share, strategy papers, and business correspondence, some of which was labelled "highly confidential."

In addition, O&O acquired at least two hard disks from a major health insurance company in the course of the study, which contained internal staff emails, internal data about customer claims for medical treatment, and the correspondence with the relevant doctors and medical data about the patients. The data could let an unauthorized person determine patients' addresses, according to O&O.

O&O describes these vulnerabilities as negligent, considering the proliferation of data protection and regulatory laws (for example, HIPAA).