[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Data Breaches](/category/data-breaches) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What Constitutes a Data Breach?](/blog/what-constitutes-a-data-breach) Publish date November 16, 2025 {x} minute read # What Constitutes a Data Breach? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Catherine Chipeta](/team/catherine-chipeta) Cybersecurity Writer Catherine's work has influenced leaders in technology, SaaS, government, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) A [data breach](https://www.upguard.com/blog/data-breach) occurs when [sensitive data](https://www.upguard.com/blog/sensitive-data) is copied, transmitted, viewed, stolen, or accessed by an unauthorized individual. For a security incident to constitute a [data breach](https://www.upguard.com/glossary/data-breach), the exposure of sensitive data isthe result of a planned cyber attack. The presence of intent [differentiates a data breach from a data leak](https://www.upguard.com/blog/data-breach-vs-data-leak), where exposure is either accidental.  A data leak occurs when data is accidentally exposed through a vulnerability, such as weak passwords, or when stolen data has been published on the dark web. [Data leaks](https://www.upguard.com/blog/data-leak) and cloud leaks can also cause a data breach if a cybercriminal exploits these vulnerabilities to gain unauthorized access to sensitive information.  The types of data exposed in a security breach include highly confidential information, such as: * Financial information, such as credit card numbers and bank account numbers * [Personally identifiable information (PII)](https://www.upguard.com/blog/personally-identifiable-information-pii), such as driver’s license numbers, social security numbers, phone numbers, and other contact information * [Protected health information (PHI)](https://www.upguard.com/blog/protected-health-information-phi) * Trade secrets * Intellectual property [Learn the differences between data breaches and data leaks >](https://www.upguard.com/blog/data-breach-vs-data-leak) Data breaches are prevalent in industries that deal with large amounts of personal data, such as the [healthcare](https://www.upguard.com/blog/cybersecurity-regulations-and-frameworks-healthcare) and [financial](https://www.upguard.com/blog/cybersecurity-regulations-financial-industry) sectors. Cybercriminals [exploit](https://www.upguard.com/blog/exploit) this information to commit lucrative cybercrimes, such as [identity theft](https://www.upguard.com/blog/identity-theft) and health insurance fraud.  ## How Do Data Breaches Happen? Examples of security incidents that lead to [data breaches](https://www.upguard.com/blog/data-breach) include: * [Malware infections](https://www.upguard.com/blog/malware) * [Ransomware attacks](https://www.upguard.com/blog/what-is-ransomware-as-a-service) * [Cyber attacks](https://www.upguard.com/blog/cyber-attack), such as [denial-of-service attacks (DoS)](https://www.upguard.com/blog/what-is-a-ddos-attack) and [brute force attacks](https://www.upguard.com/blog/brute-force-attack) * [Social engineering schemes](https://www.upguard.com/blog/social-engineering), such as [phishing](https://www.upguard.com/blog/phishing) * Insecure endpoints, such as lost or stolen hard drives or smartphones * [System vulnerabilities](https://www.upguard.com/blog/vulnerability) * [Exfiltrated data](https://www.upguard.com/blog/how-to-detect-data-exfiltration) posted in [dark web](https://www.upguard.com/blog/dark-web) forums * [Spyware](https://www.upguard.com/blog/spyware) * Insecure passwords * [Cloud misconfigurations](https://www.upguard.com/blog/cloud-misconfiguration), such as excessive permissions * [Third-party breaches](https://www.upguard.com/blog/manage-third-party-risk) [Learn how to prevent costly data breaches. Download the free guide >](https://www.upguard.com/resources/complete-guide-to-data-breaches) ## What to Do if a Data Breach Occurs Data breaches are increasingly common for organizations of all sizes - from small businesses to multinational corporations. Having a comprehensive [incident response plan](https://www.upguard.com/blog/incident-response-plan) ensures your organization knows how to identify, contain, and quantify the impact of a data breach. Follow the steps below to respond effectively and efficiently following a data breach. ### 1. Isolate Breached Systems You must ensure the breach has stopped before taking any further action. Identify the affected parts of your system, log all data, and isolate these parts to prevent further compromise. Keeping a data log is crucial to identify what data has been compromised. ### 2. Perform an Audit Once you have isolated the source of the breach, you’ll need to perform an audit to determine which data was accessed and when. The scope of the breach depends on which information was accessed or modified. Having audit logs and backups readily available helps you compare what changes have occurred in affected systems. Otherwise, a data expert can check to validate the accuracy of the audit.  ### 3. Inform Affected Customers You must inform all affected individuals as soon as possible. Data breach notification laws mandate this process, such as the [European Union General Data Protection Regulations (GDPR)](https://www.upguard.com/blog/how-to-be-gdpr-compliant), and US state laws, such as the [California Consumer Privacy Act (CCPA) ](https://www.upguard.com/blog/what-is-the-ccpa)and the [New York SHIELD Act](https://www.upguard.com/blog/shield-act).  Prompt communication can also help minimize the reputational damage caused by a breach. Provide your customers with instructions on how to secure their accounts and personal data. ### 4. Implement Data Breach Prevention Strategies Implementing effective data security processes and [information security policies](https://www.upguard.com/blog/information-security-policy) is essential to [prevent data breaches](https://www.upguard.com/blog/prevent-data-breaches) in the future. Effective prevention strategies include: * Following the [SANS institute security guidelines](https://www.sans.org/critical-security-controls/guidelines) * Managing cyber risk with the [NIST Cybersecurity Framework](https://www.upguard.com/blog/nist-cybersecurity-framework) * Implementing the [principle of least privilege](https://www.upguard.com/blog/principle-of-least-privilege) * [Improving password security](https://www.upguard.com/blog/the-password-security-checklist) * Implementing [two-factor authentication (2FA)](https://www.upguard.com/blog/two-factor-authentication) or multi-factor authentication (MFA) * Deploying an [attack surface management solution](https://www.upguard.com/) [*Learn how to prevent data breaches.*](https://www.upguard.com/blog/prevent-data-breaches) ## Examples of Data Breaches Below are examples of recent well-known data breaches. ### Microsoft In January 2021, [Microsoft Exchange’s](https://www.upguard.com/security-report/microsoft) email servers were involved in [one of the US’ most significant cyberattacks to date](https://www.upguard.com/blog/cve-2021-26855). More than 60,000 companies were affected worldwide, 30,000 of which were US-based. The attackers were able to gain access to emails containing sensitive data by exploiting four [zero-day vulnerabilities](https://www.upguard.com/blog/zero-day).  The email accounts were connected to various organizations, including small businesses and local governments. The software flaw allowed the hackers to remain active in the vulnerable systems for three months.  ‍ ### Linkedin In April 2021, hackers performed an illegal data scrape of [LinkedIn’s](https://www.upguard.com/security-report/linkedin) user base, revealing the personal details of over 700 million users. This exposure enabled additional cybercriminals to take advantage of the breached data. One threat actor reportedly tried selling a set of LinkedIn data on a public forum for $7000 in Bitcoin.  ### Yahoo  Between 2013 and 2016, [Yahoo](https://www.upguard.com/security-report/yahoo) was hit by several cyber attacks. A team of Russian hackers exploited Yahoo’s database, stealing records containing personal information from about 3 billion user accounts in total. Yahoo’s delayed reaction to the attack and failure to disclose one of the security incidents to its users resulted in a $35 million fine and 41 class-action lawsuits.  ### Equifax In September 2017, primary credit reporting agency [Equifax](https://www.upguard.com/security-report/equifax) reported a significant data breach that compromised the publicly identifiable information (PII) of 148 million US citizens. The breach also affected many financial institutions that used Equifax as a [third-party vendor](https://www.upguard.com/blog/third-party-vendor). Due to their poor network security, Equifax eventually faced penalties to the tune of $575 million to be paid to numerous authorities, states, and territories. [*See our full list of the biggest data breaches.*](https://www.upguard.com/blog/biggest-data-breaches) eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Attack Surface Management #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 Data Breaches #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Data Breaches #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Data Breaches #### [How to Prevent Data Breaches in 2026 (Highly Effective Strategy)](/blog/prevent-data-breaches) Learn how to implement an effective security control strategy for defending against data breaches in 2026. [](/team/edward-kost) [Edward Kost](#) October 21, 2026 Attack Surface Management #### [Attack Surface Management Vendors Compared](/blog/attack-surface-management-vendors-compared) We compared ASM vendors and helped you rate them before agreeing to a POC! [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Attack Surface Management #### [The Blind Spot in Brand Protection: Why App Stores Slip Past Standard Monitoring](/blog/the-blind-spot-in-brand-protection-why-app-stores-slip-past-standard-monitoring) Do Brand Protection Solutions scan the Apple App Store and Google Play? Don't wait to find out. [](/team/lance-turner) [Lance Turner](#) September 22, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)