You Can't Leak What You Don't Hold
This year, two of Europe's most security-conscious institutions were hit by breaches — one through a zero-day no patch existed for. The lesson isn't that anyone failed at security. It's that the size of a leak is decided years before the attacker shows up, by how much data you keep. Data minimisation is attack surface reduction.