Crypto-Shredding Leaves Erased Data Recoverable in Pre-Erasure Backups

Crypto-shredding is a widely used technique where individual records are encrypted with unique keys, and erasure is achieved by deleting those keys rather than the data itself. However, a critical flaw exists: backups taken before an erasure still contain the wrapped data encryption key alongside the ciphertext, and since the master key remains active, the erased record can be fully restored from any old backup. The root problem is that deleting a key from the live database does not eliminate copies of that key stored inside historical backups. The correct fix requires a full master key rotation and destruction cycle — re-wrapping all live keys under a new master key and permanently destroying the old one — so that pre-erasure backups become truly unreadable. This means an organisation's actual erasure guarantee is only as strong as its master key rotation cadence, not the moment a record is marked as deleted.