A data breach is a security incident in which confidential data is accessed, disclosed, or stolen by an unauthorized party. It exposes records such as names, passwords, payment details, or health information to people who were never meant to see them. Breaches come from hacking, phishing, stolen credentials, misconfiguration, insiders, and lost devices, and they hit individuals, companies, and governments alike. The data that leaks rarely stays still: it is sold, combined with older leaks, and fed into automated attacks on other accounts, which is why the response to a breach matters as much as the breach itself.
What Is a Data Breach?
A data breach is an incident in which confidential data is accessed or disclosed to an unauthorized party. The data may be stolen by an outside attacker, exposed through a misconfiguration, or leaked by someone inside the organization. The General Data Protection Regulation (GDPR) defines a personal data breach as a breach of security leading to the unlawful destruction, loss, alteration, or disclosure of personal data.
A breach is more specific than a security incident in general. Any unauthorized event on a system is an incident; it becomes a breach only when protected data is actually exposed. That distinction drives the legal duties that follow, because notification laws are triggered by the exposure of personal data, not by every failed login or blocked intrusion.
What Are the Common Causes of a Data Breach?
Most breaches trace back to a small set of root causes, and identity-based attacks lead them. The Verizon 2025 Data Breach Investigations Report ranks credential abuse as the most common initial access vector at 22 percent, followed by vulnerability exploitation at 20 percent and phishing at 16 percent, with a human element present in 60 percent of breaches. The four cards below cover the causes behind the great majority of incidents.
The credential weaknesses behind so many breaches connect directly to password practice, covered in the guide on how to build a strong and unique password. Vulnerability exploitation, the second-ranked cause, is the same unpatched-software problem that opened the Equifax breach.
What Data Is Exposed in a Breach?
A breach can expose identifiers, credentials, financial records, and sensitive personal data, and the type of data decides how much harm follows.
- Identifiers: names, email addresses, phone numbers, and government identification numbers such as Social Security numbers. These feed identity theft directly.
- Credentials: usernames and passwords, often stored as hashes that attackers then try to crack. Reuse turns one leak into access across many services.
- Financial data: payment card numbers, bank details, and transaction records, which enable fraud and account takeover.
- Sensitive data: health records, biometric data, and similar categories that carry stronger legal protection and cannot be reissued like a password.
Exposed credentials carry outsized risk precisely because people reuse passwords. The role of hashing and salting in limiting that damage is explained in how hashing protects stored passwords. Sensitive identifiers are worse still, since a leaked Social Security number or fingerprint cannot simply be changed.
How Much Does a Data Breach Cost?
The global average cost of a data breach was USD 4.44 million in 2025, the first decline in five years. IBM credits faster detection and containment, increasingly aided by security AI, for the drop. The cost is not evenly spread: it varies sharply by region and industry, and a few factors push individual breaches well above or below the average.
- Detection and escalation. The work to discover the breach and assess what was taken, including forensics and audit.
- Notification. Telling regulators, affected people, and partners, which laws often require within days.
- Post-breach response. Help desks, credit monitoring for victims, legal costs, and regulatory fines.
- Lost business. Customer churn, downtime, and reputational damage, usually the largest single share of the total.
Speed is the biggest lever on cost. IBM found the mean time to identify and contain a breach fell to 241 days in 2025, a nine-year low, and organizations that detect faster pay less. New risks cut the other way: breaches involving shadow AI, meaning unsanctioned AI tools used without oversight, added roughly USD 670,000 to the average, and AI-assisted phishing lets attackers operate at far greater scale.
What Are Major Examples of Data Breaches?
The largest breaches show the full range of scale, from billions of accounts to nation-sized leaks of identifiers. Older record-setters sit alongside a wave of major 2024 and 2025 incidents.
- Yahoo (disclosed 2016 to 2017): breaches affecting all three billion accounts, still the largest known breach by account count.
- Equifax (2017): the personal and financial data of roughly 147 million people, exposed through a single unpatched vulnerability.
- Change Healthcare (2024): a ransomware attack that exposed the protected health data of an estimated 190 million people, the largest healthcare breach in United States history.
- National Public Data (2024): a leak of about 2.9 billion records including names, addresses, and Social Security numbers, traced to a back-end password the company had inadvertently published.
- Snowflake customer campaign (2024): attackers used stolen credentials to reach data held by more than 100 companies in cloud accounts that lacked multi-factor authentication.
The pattern across the recent cases is consistent with the cause data: stolen credentials and a missing second factor opened the Snowflake campaign, a simple misconfiguration exposed National Public Data, and an unpatched weakness still echoed in Equifax. Aggregated dumps from these and other breaches now circulate and power the automated credential-stuffing attacks that start the next round.
What Are the Consequences of a Data Breach?
A breach produces identity theft, financial fraud, reputational damage, and regulatory penalties, and the harm falls on individuals and the breached organization at once.
- Identity theft: exposed identifiers are used to open accounts or file fraudulent claims in a victim’s name. See what identity theft is.
- Financial fraud: exposed payment data leads to unauthorized charges and account takeover.
- Reputational damage: customers lose trust, and lost business is usually the largest part of the total cost.
- Regulatory penalties: laws such as the GDPR can fine up to 4 percent of global annual revenue for serious failures.
A single breach can trigger several of these at once for one exposed person. The broader harm that follows weak handling of personal data is covered in how weak data privacy leads to identity theft.
How Should a User Respond to a Data Breach?
If your data is in a breach, act fast: change passwords, turn on multi-factor authentication, and monitor your accounts. Quick action shrinks the window in which exposed data can be used against you.
- Change the password on the affected account, and on every other account where you reused it.
- Turn on multi-factor authentication so a stolen password alone cannot open the account.
- Monitor your money. Watch bank and card statements and your credit reports for activity you did not authorize.
- Freeze your credit with the major bureaus to block new accounts opened in your name. A freeze does not affect existing accounts.
- Check your exposure on Have I Been Pwned to see which breaches included your email, and repeat the steps above for each.
Reused passwords are what turn one breach into access across many services, so unique passwords are the strongest preventive step you control. A credit freeze is free and reversible, and it blocks the new-account fraud that follows a leak of identifiers.
How Does Have I Been Pwned Help?
Have I Been Pwned lets you check whether your email or password appears in known breaches. The free service aggregates publicly disclosed breaches into one searchable database.
- Email search reports which known breaches included a given email address.
- Password check confirms whether a password has appeared in any breach corpus, without ever sending the full password.
- Breach alerts notify subscribers when their address shows up in a newly added breach.
- Domain monitoring lets an organization track exposure across its own email domain.
A match means the credential is exposed and should be changed at once, especially if it is reused. The password check uses a privacy-preserving range query, so only a short prefix of the hashed password ever leaves your device and the service never sees the password itself.
How Can Organizations Prevent Data Breaches?
Organizations cut breach risk by patching systems, encrypting data, restricting access, and training staff. Prevention works by closing the common causes before exposure happens.
- Patch management closes known vulnerabilities before attackers exploit them, as the Equifax breach made clear.
- Encryption at rest renders stolen records unreadable without the keys.
- Access control limits each account to the minimum data its role requires.
- Multi-factor authentication blocks the stolen-credential and phishing attacks that top the cause rankings.
- Security training reduces the phishing success that hands attackers a way in.
Encryption limits the value of stolen data, since ciphertext without keys cannot be read. Its role in protecting stored records is explained in how encryption keeps stored data unreadable, and the wider set of organizational defenses sits within cybersecurity.
What Is the Difference Between a Data Breach and a Data Leak?
A data breach involves unauthorized access by an attacker, while a data leak is accidental exposure with no intruder. The cause separates the two terms, though the outcome often overlaps.
- Breach: a deliberate intrusion such as hacking or credential theft.
- Leak: an accidental exposure such as a misconfigured database left public.
- Intent: a breach implies an attacker, while a leak implies an internal mistake.
- Outcome: both expose protected data, and both trigger the same notification duties.
The words are often used interchangeably because the result is the same exposure of protected data. The GDPR treats both as personal data breaches subject to the same reporting obligations, so the legal duty does not turn on whether an attacker was involved.
What Are Breach Notification Requirements?
Notification laws oblige organizations to report qualifying breaches to regulators and affected people within set deadlines. Disclosure is mandatory rather than optional, and the clock differs by law.
Mandatory notification exists so affected people can act before exposed data is misused. Missing a required window adds regulatory penalties on top of the breach itself, which is part of why faster detection lowers total cost.
How Does Multi-Factor Authentication Limit Breach Damage?
Multi-factor authentication limits breach damage by demanding a second proof of identity beyond the password. Because so many breaches expose reused passwords, a second factor is what stops the account takeover that would otherwise follow.
- Knowledge plus possession: a password is combined with a device-based code or a security key.
- Stolen credentials fall short: the attacker still lacks the second factor, so the leaked password alone is not enough.
- Phishing resistance: authenticator apps and hardware keys resist phishing far better than codes sent by text message.
- Real-world proof: the Snowflake campaign succeeded largely against accounts that had no multi-factor authentication enabled.
Hardware security keys give the strongest protection because they bind the login to the genuine site and resist the phishing that can capture text-message codes. The mechanics of verifying identity are covered in cybersecurity across the wider cluster.
Last Thoughts on Data Breaches
A data breach exposes confidential records to an unauthorized party through stolen credentials, phishing, misconfiguration, insiders, or lost devices, and the recent data is clear that identity-based attacks lead. The cost is real and measurable: a global average of USD 4.44 million in 2025 and a mean of 241 days to identify and contain, with shadow AI and AI-assisted phishing adding new pressure. Incidents from Yahoo and Equifax to Change Healthcare, National Public Data, and the Snowflake campaign show both the scale these events reach and how ordinary the root causes usually are.
For an individual, the response is the same every time: change reused passwords, turn on multi-factor authentication, watch your accounts, and check your exposure on Have I Been Pwned. For organizations, patching, encryption, least-privilege access, and a tested response plan close the common paths and shorten the costly detection window. Data breaches connect to data privacy, hashing, identity theft, and password practice across the security cluster, and the hub on cybersecurity places them within the wider field of information protection.
Key Takeaways:
- A data breach is the unauthorized access or disclosure of confidential data, distinct from a general security incident.
- Identity-based attacks lead the causes: phishing is the top initial vector at 16 percent (IBM), and credential abuse ranks first at 22 percent (Verizon).
- The global average breach cost USD 4.44 million in 2025, and detection and containment took a mean of 241 days.
- Recent record-setters include Change Healthcare (about 190 million), National Public Data (about 2.9 billion records), and the Snowflake campaign.
- If your data is breached, change reused passwords, enable multi-factor authentication, monitor accounts, and freeze your credit.
- The GDPR sets a 72-hour reporting deadline, and the SEC requires Form 8-K disclosure within four business days of a material incident.
Frequently Asked Questions (FAQs)
What is a data breach in simple terms?
A data breach is a security incident in which confidential data is accessed, disclosed, or stolen by someone who was never authorized to see it. It can result from hacking, phishing, stolen credentials, misconfiguration, an insider, or a lost device, and it exposes records such as names, passwords, payment details, or health data.
What is the most common cause of a data breach?
Identity-based attacks lead. The IBM Cost of a Data Breach 2025 report found phishing was the single most common initial attack vector at 16 percent, narrowly ahead of stolen or compromised credentials. The Verizon 2025 DBIR ranks credential abuse first at 22 percent, with vulnerability exploitation and phishing close behind, and human error present in 60 percent of breaches.
How much does a data breach cost?
The global average cost of a data breach was USD 4.44 million in 2025 according to IBM, the first decline in five years, helped by faster detection using security AI. Costs vary widely by country and industry, and United States breaches remain far above the global average. Shadow AI, meaning unsanctioned AI tools, added about USD 670,000 to the average breached organization.
How long does it take to detect a data breach?
Organizations took a mean of 241 days to identify and contain a breach in 2025, the lowest figure in nine years per IBM. That window is the gap during which stolen data can be sold or abused, which is why early detection and a tested response plan matter as much as prevention.
What should I do if my data is in a breach?
Change the password on the affected account and on any other account that reused it, then turn on multi-factor authentication. Watch your financial statements for unauthorized charges and consider freezing your credit with the major bureaus to block new accounts opened in your name. Check Have I Been Pwned to see where your email has appeared.
How fast must a company report a data breach?
It depends on the law. The GDPR requires notifying a supervisory authority within 72 hours of becoming aware of a qualifying personal data breach. In the United States, the SEC requires public companies to disclose a material cybersecurity incident on Form 8-K within four business days of deciding it is material, and state and sector laws such as HIPAA add their own timelines.
