Businesses unnecessarily storing massive amounts of useless data create a “data hoarding” situation hackers love to exploit, according to a cybersecurity expert.

On average, two-thirds of the data stored by businesses is not needed and should be destroyed, said Tim Ayling, vice president of cybersecurity for Europe, Middle East, and Africa at information technology security company Imperva. Holding on to data creates vulnerabilities for businesses by giving cyberattackers more avenues to access an organization’s computer systems.

The more data a business has, the broader its attack surface is, meaning there are more possible vulnerabilities available for a hacker to exploit. If hackers can get access anywhere on a system, it might allow them to gain entry to other areas and extract other data they want.