What is a data breach? Types, causes and consequences

What counts as a data breach

A data breach is any incident in which data is accessed, disclosed, altered or lost without authorisation. It does not have to involve a dramatic intrusion — leaving a database exposed to the internet, emailing a spreadsheet to the wrong person, or losing a laptop can all be breaches.

Under the EU GDPR the formal term is a "personal data breach", and one that risks harm to individuals must be reported to the regulator within 72 hours.

Common causes

• Stolen or leaked credentials — reused or phished passwords that unlock accounts.
• Misconfiguration — databases, cloud storage or backups left publicly accessible.
• Software vulnerabilities — unpatched flaws exploited to reach data.
• Phishing and social engineering — tricking a person into granting access.
• Third-party compromise — a supplier or service you use is breached, exposing your data.

What gets exposed

The impact of a breach depends heavily on what leaked:

• Credentials (email + password): the most reusable and dangerous, enabling account takeover elsewhere.
• Personal data (PII): names, addresses, phone numbers — permanent, and fuel for phishing and identity fraud.
• Session tokens and keys: can grant access without a password, sometimes bypassing MFA.
• Financial data: card and banking details enabling direct fraud.

Why the damage outlasts the breach

A leaked password from a site you forgot about can be used years later, because attackers aggregate old and new leaks into combolists and replay them automatically. This is why "it was an old account" is not reassurance — and why breach monitoring and unique passwords matter long after the original incident.