I worked at a tech company, three times my personal data was put at risk because someone at HR left their laptop in their car during a night on the town.

I asked if my personal data was stored in files downloaded to the laptop, they said yes.

When I asked why my data needed to be downloaded to the laptop and not limited to just online access they stopped responding.

This of course was the same company who mailed me my co-workers salary in spreadsheet form, twice because my name was similar to another manager.

Why that was necessary was beyond me too.

Data security professionals don’t make these decisions, random developers do. And they do what is easiest.

At most large companies, IT sets the policy and developers are required to work within that policy. I've worked at about 10 jobs. The only one where devs could write their own ticket was a startup

IT doesn’t have any involvement when it comes to S3 buckets at any company I’ve seen. Anything in a cloud tenancy is devops acting with autonomy. Sometimes they have a security person review it, but many companies don’t do that, and the ones that do have way more moving parts than their security engineers are capable of reviewing, so stuff gets through.

Even then, it’s unlikely that a security person would recommend compartmentalizing this particular data set. Any application that needs access to some of it probably needs access to all of it, and it makes little difference if you compromise a server and get one key or if you get 30 keys. The trust boundaries haven’t moved, so it would increase cost without really mitigating any threats.

I don’t think they even had a legitimate reason to keep this data around. Surely they aren’t all active accounts and s3 isn’t a place the data likely needs to be long term.

They have to keep the data at least 7 years because of some regulation(s)

Doesn’t excuse what happened, obviously