Data breach

An incident in which sensitive data is exposed to people who should not have it.

For example, a company's customer database might be copied by hackers, or a misconfigured server might leave records open to anyone on the internet.

An event in which personal or confidential data is accessed, disclosed, or lost without authorization. Authorization means permission granted by the organization that holds the data.

Breaches happen in several ways:

• Hacking and malware, in which attackers break into systems and copy data.
• Stolen credentials, in which attackers sign in with real usernames and passwords from earlier leaks or phishing.
• Misconfiguration, in which a database or storage service is left open by mistake.
• Insiders, in which an employee misuses access.
• Third parties, in which a vendor or partner that holds data is compromised.
• Lost or stolen devices, which carry unencrypted data.

A breach response typically follows these steps:

1. The organization detects the incident and works out what was exposed.
2. It contains the problem by closing access and removing the attacker.
3. It notifies regulators and affected people as the law requires. The GDPR, for example, generally requires notice to the regulator within 72 hours of becoming aware of a personal data breach.
4. It investigates the cause and fixes the weaknesses.

Stolen data rarely stays unused. It feeds other crimes:

• Credential stuffing, which replays leaked logins on other sites.
• Fullz, which are complete packages of identity details sold to fraudsters.
• Synthetic identity fraud, which builds new identities from stolen details.

A data breach sits next to terms that are easy to mix up:

• PII (Personally Identifiable Information) is the kind of data whose exposure makes a breach serious.
• Credential stuffing is an attack that uses breached logins.
• GDPR is the EU law that sets breach notification rules.