MySQL Security - Storing lots of sensitive phone numbers securely?
If you store encrypted data in the database, the data is not understandable anymore without a layer of code on top. This might seem like a good move, but if one takes a closer look, it complicates things and does not provide more security.

An example which becomes a lot more complicated: "Compute the number of phone numbers with a special area code". How to do this in a normal DB? Well something like SELECT COUNT(*) FROM phonenumbers WHERE phonenumber LIKE "XZY%" will work. How to do this, if the database cannot understand its own data? Transfer everything to the application, decrypt it and compute the result there. That can obviously be really cumbersome with large databases. Basically all advantages one receives through using a DBMS are nullified.

Why this is not more secure? One does not even have to hack your database anymore, it is enough to hack the application. Likely this is easier, since the application uses a lot of custom code. Further the firewall will allow access to the application servers, while it will likely prohibit access to database servers from outside.

What to do instead? Secure the database server and restrict access to sensitive data. You can (should) create a dedicated area for sensitive data, which can only be accessed with dedicated database accounts. This credentials should be used rarely in your application, and should not be handed over easily to e.g. developers. You could even set up an own dedicated isolated database server for such sensitive information.