ESG Research: SaaS-resident data is not immune from exposure to cybercriminals