Neil Ashby

The mistake

A nightly job meant to protect against accidental data loss is written to restore anything deleted in the last 24 hours, with no distinction between an accidental deletion and a deliberate one. This means there is no way to honor an explicit account-deletion request, since the same job that restores accidentally-dropped rows also restores rows a user asked to have permanently removed. Worse, this restore job is the only backup mechanism in place, so it can't simply be disabled without losing real disaster-recovery coverage.