Data Breach.

What is a data breach?

A data breach is an event where information is accessed, taken or disclosed by someone who should not have it, or used for a purpose it was not meant for. The NIST glossary defines the related term breach, and that definition is the base for this page.

How does NIST define a breach?

NIST glossary entries for breach come from several government sources. One of them describes a breach as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence. In that definition, a person other than an authorized user accesses or potentially accesses personally identifiable information, or an authorized user accesses it for an other than authorized purpose.

Personally identifiable information, often shortened to PII, is information that can be tied to a person. NIST SP 800-175A uses wider words. It covers persons other than authorized users, or authorized users acting for other than authorized purposes, who have access or potential access to sensitive information, whether physical or electronic.

What does this mean in plain terms?

Two points stand out in these definitions. First, a breach does not need proof that data was copied. The words “potentially accesses” show that possible access can count. Second, the person does not have to be an outsider. An authorized user who uses data for the wrong purpose can also cause a breach.

A simple illustration

This is a generic example, not a real case. An organization stores customer records. A person without permission gets into the system that holds them. Under the NIST wording above, this would be a breach, because an unauthorized person accessed personally identifiable information.

What should an organization do after a breach?

CISA covers this in its #StopRansomware Guide, which includes steps for data breach notification. CISA says organizations should follow the notification requirements in their cyber incident response and communications plan. It also says they should make sure their data breach notification procedures follow applicable state laws.

When personally identifiable information is compromised, CISA says affected individuals should be told the type of information exposed. They should also get recommended remediation actions and contact information, so they can take steps to protect themselves. CISA adds that a business should notify other businesses if it stores their PII on their behalf and that PII is stolen. For electronic health records, CISA says the entity may need to notify the FTC or HHS.

How do authorities look at breach severity?

ENISA, the European Union Agency for Cybersecurity, worked with the data protection authorities of Greece and Germany on an updated method to assess the severity of personal data breaches. ENISA says the method is meant to be used both by data protection authorities and by data controllers. A data controller is an organization that decides how and why personal data is processed. ENISA also notes earlier recommendations on how to detect and assess breaches, notify individuals and authorities, and respond.

Is a data breach the same as a cyber attack?

Not always. A cyber attack describes how someone acts against a system. A breach describes the result for data. Per the NIST wording, a breach can also involve an authorized user who misuses data.

Is a data breach the same as data exfiltration?

No, they are related but not identical. Data exfiltration usually means data is taken out of an organization. The NIST wording for breach is wider, because it also covers unauthorized access and possible access.

On our incident pages, the 2023 Latitude Financial case began, Latitude said, with stolen employee login credentials, while the 2025 Kazakhstan resident database leak shows that a leaked database is not always a breach of the owner’s systems, because officials there said no government system was breached.