Nobody was using that old server. The hackers were.
In 2026, a Tampa Bay area dental practice disclosed a ransomware attack after discovering on January 19 that files on a legacy server had been encrypted. According to the disclosure, that server contained backup copies of electronic medical records. The investigation found patient information had been exposed for about 6,400 people, including names, contact details, dates of birth, treatment notes, clinical histories, and for a limited number of patients, Social Security numbers.
The server wasn't the practice's main system. It was a holdover. And that's exactly why it's such an important lesson.
Why forgotten systems are so dangerous
Legacy systems tend to share the same weaknesses:
• They stop getting updates. Either the software is past end of life, or no one remembers to patch it.
• No one is watching them. Security monitoring often focuses on systems people use daily.
• They still hold sensitive data. Old backups, archived client files, and former software databases rarely get cleaned out.
• They're still connected. If a device is on the network, an attacker who gets in can reach it.
Attackers love these systems. They're easier to break into, less likely to trigger alerts, and often hold years of data in one place.
What we commonly find in Tampa Bay offices
When we walk through small businesses around Wesley Chapel and Tampa, we often find:
• A file server from a previous IT provider "kept just in case"
• An old desktop in a back room still running Windows 10 or older
• A former practice or agency management system that was replaced but never shut down
• A network storage drive filled with years of backups
• A router or firewall nobody has logged into since installation
Owners are often surprised. These systems were set up years ago, by someone who's no longer around, for a purpose nobody remembers.
How to deal with legacy systems
1. Inventory everything. Network scanning and remote management tools reveal every device connected to your network.
2. Identify the owner and purpose. For each system, answer: what does it do, who uses it, and what data is on it?
3. Decide: keep, migrate, or retire. If it's still needed, it must be patched and monitored like everything else. If it holds data you must keep, migrate that data to a secure, supported location.
4. Retire properly. Securely wipe or destroy drives before disposal, and document it.
5. Apply retention rules. Don't keep data forever just because storage is cheap. Old data is a liability.
6. Keep backups protected. Backup copies deserve the same security as the original data, including encryption and isolation.
For Florida insurance agencies
Agencies switching management systems or merging books of business often end up with old databases and file shares full of client records. Rule 69O-128.032 expects you to safeguard customer information wherever it's stored, including on systems nobody uses anymore.
Take a walk through your office
This week, look at every closet, shelf, and desk corner with a blinking light. For each one, ask: what is that, and do we still need it? The answer might surprise you.
Main Event Managed Services helps Wesley Chapel and Tampa Bay businesses inventory, secure, and properly retire old technology. Learn more at maineventmsp.com.
