The way you protect old data is by routinely auditing what you have. You make sure each department is on top of organizing its data. If you're not sure what it is, you offline it. It can always be brought back online if necessary. Even lowest-common-denominator schemes like ISO 27001, a system designed to allow management that doesn't even know how to turn on a computer to manage information security, covers this basic idea. It would be one thing if a non-technical department had leaked some ancient folder full of reports containing some sensitive data, but this is a database dump of one of the most highly trafficked sites on the net. Reasonable people should expect the custodians of those sorts of things to know better. To anyone with technical knowledge, minimizing your data exposure should be as natural as breathing.

And yet again this time we get the usual "the attack was so sophisticated" refrain. Oh, the defenders were so careful, and tried to take every precaution for sure! The attackers hacked the 2FA! If that's true why didn't the attackers get the 2018 data? Frankly I don't believe the Reddit management. They probably left that old database dump on some old system they forgot about that tons of people had access to.

How many breaches to we need to remind us to be aware of what data we are managing and take precautions? How many more is it going to take before we collectively stop being so careless?