Home / Knowledge hub / Data breach
Knowledge hub
Data breach
Information you hold ends up somewhere it should not be.
What it means
A data breach happens when information you hold ends up somewhere it should not be. An outsider reads it, a copy goes to the wrong recipient, a backup sits open, or one customer sees another customer's records.
None of this needs a dramatic attack. A missing permission check on one endpoint, quietly used for months, counts as a breach in every sense that matters to the people whose data it was.
Why it matters
Engineers fix the flaw in an afternoon. The expensive part is everything else: notifications, customer calls, contract reviews, enterprise deals that pause, and a long conversation about what you had tested and when. Those costs barely move with the number of records.
There is a real difference between a breach and an incident you can explain. The same flaw, found by your own testing and fixed with a dated record behind it, is a paragraph in a security review. Found by a customer, it becomes a notification and a year of the same sales question. The technical facts are identical. Only the order of discovery changed.
How it shows up
Two questions decide how the following weeks go, and you answer both long before anything happens. Can you say exactly which records somebody reached, using which account, at what time? And can you show you had been testing the thing that failed?
A usable audit log answers the first, which is why OWASP treats logging as a design decision rather than an afterthought. A dated record of your testing answers the second. You cannot assemble either one afterwards.
Questions people ask
Data breach, answered
What actually counts as a data breach?
Any time personal or confidential data goes somewhere it should not, including by accident. A misdirected export and a stolen database are both breaches.
Availability counts in many regimes too. Losing the only copy of customer data can qualify, even though nobody read it.
How quickly do we have to report one?
It depends on where your customers are, what data you hold and which industry rules apply, and the deadlines differ widely. The common thread is that the clock starts when you become aware, not when the investigation finishes.
Get the answer from a lawyer before you need it, and write it into your incident plan. Working it out during the incident is how teams miss a deadline.
Do we have to tell customers if we found it ourselves and fixed it fast?
Often yes, and the fact that you found it yourself changes the tone of the conversation rather than the duty. That duty depends on the data and the law that covers it.
What helps is evidence. Logs showing which records were reached, and by whom, let you notify accurately instead of assuming the worst.
What is the difference between a security incident and a breach?
An incident is anything that threatens your systems or data. A breach is the subset where data actually escaped or got exposed.
NIST's incident handling guidance treats them as stages of one process. Most incidents never become breaches, which is exactly why the logging matters.
We are a five-person company. Would anyone even target us?
Most of this is not targeting. Automated traffic finds an exposed endpoint or a reused password and does not know or care how big you are.
Small teams also carry the cost badly. One enterprise customer pausing a contract hurts more at five people than a fine does.
Sources
Where this comes from
Related
Terms that sit next to this one
Incident response
The agreed plan for the hours after something has gone wrong.
Audit log
A record of who did what and when, kept so you can answer later.
PII
Any data that points at a specific human being.
Access control
The rules deciding which person can see or do which thing in your app.
Logging and monitoring
Recording what happens, and actually watching what gets recorded.
Find it before your customers do.
The cheapest week to find a missing permission check is the week before anyone else does. We test one application, prove what we find, and date the report. Thirty days costs $199.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.