Data Breach

A data breach is a security incident where protected, sensitive, or confidential data is accessed, disclosed, or stolen by unauthorized parties.

A data breach occurs when personal or sensitive information is exposed to unauthorized access. Breaches trigger legal notification requirements and can cause significant harm.

Types of breaches: - External Attack: Hacking, malware, phishing - Insider Threat: Employees or contractors - Accidental Exposure: Misconfiguration, lost devices - Vendor Breach: Third-party compromise

Breach response steps: 1. Contain and investigate 2. Assess scope and impact 3. Notify regulators (if required) 4. Notify affected individuals 5. Remediate and improve defenses

Notification requirements: - GDPR: 72 hours to regulator - HIPAA: 60 days to HHS and individuals - State laws: Typically 30-60 days

Why It Matters

The average data breach costs $4.88 million and takes 277 days to identify and contain. Beyond direct costs, breaches cause lasting reputational damage—customers lose trust, stock prices drop, and regulatory scrutiny intensifies. Organizations with strong security controls, incident response plans, and compliance certifications like SOC 2 experience significantly lower breach costs and faster recovery.

Key Points

Must be reported within regulatory timeframes

GDPR requires 72-hour regulator notification

Document all breach response actions

Legal counsel should be involved

May result in fines and lawsuits

Applicable Compliance Frameworks

GDPR HIPAA PCI DSS SOC 2

Related Terms

Incident Response

Incident response is a structured approach to preparing for, detecting, containing, and recovering from security incidents while minimizing damage.

GDPR

GDPR (General Data Protection Regulation) is the EU's comprehensive data privacy law that governs how organizations collect, process, and protect personal data of EU residents.

HIPAA

HIPAA (Health Insurance Portability and Accountability Act) is a US federal law that establishes standards for protecting sensitive patient health information (PHI) from disclosure without consent.