That is what I ran into. And then the one that I found that was left alone. I found XML data that was never obfuscated or de-identiified stored in the test DB before me. I had a "s--t-fit" and brought it to management in a way that I was covered and left their butts hanging.

I can't afford +$100K in fines.