Criminals sitting on stolen data ‘timebomb’