Table of Contents<\/h4>\nData Breach Definition\n<\/a>
\nHow Does a Data Breach Happen?\n<\/a>
\nThe 4-Step Process of Malicious Data Breaches\n<\/a>
\nThe Effects of Data Breaches\n<\/a>
\nWhy Do People Steal Data?\n<\/a>
\nData Breach Prevention: How to Keep Your Data Secure\n<\/a>
\nHow to Check if Your Data Has Been Exposed\n<\/a>
\nWhat to Do if Your Data Has Been Compromised in a Cybersecurity Breach\n<\/a>
\nExamples of Major Data Breaches\n<\/a>
\nData Breach FAQs\n<\/a>
<\/div>\n\n\n\n\nData Breach Definition<\/h2>\n\n\n\n
A data breach happens when information is accessed, taken, or disclosed by a third party without authorization.<\/strong> It can be powered by files stolen by a cybercriminal, records emailed to the wrong recipient, information found on a lost or stolen laptop, and a variety of other sources.<\/p>\n\n\n\nWhether it\u2019s called a cybersecurity breach, a security breach, a data compromise, or a data spill, a data breach always results in information ending up in the hands of people who were never authorized to see it.<\/p>\n\n\n\n
It\u2019s good to keep in mind that someone doesn\u2019t necessarily have to steal data for a breach to occur. Unauthorized access on its own is enough<\/strong> \u2013 even if nothing gets copied \u2013 as is losing track of data you\u2019re responsible for.\u00a0<\/p>\n\n\n\nFor example, a contractor who opens patient files they have no business reading causes a breach. So does an organization that can\u2019t account for where a set of records went. Nobody profited in either case, but the data is still compromised.<\/p>\n\n\n\n
Types of Data Breaches<\/h3>\n\n\n\n
Breaches can be described by the kind of data involved. The most common types are:<\/p>\n\n\n\n
\n- Personally identifiable information (PII) breaches:<\/strong> Exposure of details that identify a specific person, such as names, addresses, dates of birth, and Social Security numbers.<\/li>\n\n\n\n
- Financial data breaches:<\/strong> Exposure of payment card numbers, bank account details, and transaction histories, usually taken from retailers, banks, or payment processors.<\/li>\n\n\n\n
- Health data breaches:<\/strong> Exposure of medical records, diagnoses, prescriptions, and insurance details held by providers, insurers, and claims processing contractors.<\/li>\n\n\n\n
- Credential breaches:<\/strong> Exposure of usernames and passwords, which attackers then try on unrelated services in the hope that the same login was reused.<\/li>\n\n\n\n
- Biometric data breaches:<\/strong> Exposure of fingerprints, facial scans, and voice patterns. Unlike a password, these identifiers can\u2019t be reset once they\u2019re out.<\/li>\n\n\n\n
- Intellectual property breaches:<\/strong> Exposure of source code, product designs, research data, and internal strategy documents.<\/li>\n\n\n\n
- Employee data breaches:<\/strong> Exposure of staff records, including payroll data, home addresses, performance reviews, and background check results.<\/li>\n<\/ul>\n\n\n\n
How Does a Data Breach Happen?<\/h2>\n\n\n\n
Breaches start either inside an organization or outside of it.<\/strong> Insiders usually have access to at least some data and can either misuse it or make a mistake with it. External attackers have to find a way in first, and they have plenty of tactics for doing that.<\/p>\n\n\n\n![\"The](\"https:\/\/www.privateinternetaccess.com\/blog\/wp-content\/uploads\/2026\/08\/image-1-800x1024.png\")
<\/figure>\n\n\n\nInsider Breaches<\/h3>\n\n\n\n
An insider breach involves someone who already has legitimate access to the data,<\/strong> whether that\u2019s an employee, a contractor, or a vendor with valid credentials to access an organization\u2019s systems. No perimeter gets crossed,<\/strong> which is part of what makes these breaches hard to identify.<\/p>\n\n\n\nThere are two broad types of insider breaches:<\/p>\n\n\n\n
\n- Accidental:<\/strong> Exposure caused by error rather than intent. Someone with legitimate access mishandles data, and it ends up somewhere it shouldn\u2019t be. This might look like a spreadsheet being sent to the wrong recipient, a storage permission that should be private being set to public, or misplacing a work phone.<\/li>\n\n\n\n
- Malicious:<\/strong> Deliberate theft or disclosure by someone trusted with access. The motive is usually money, sometimes grievance, and sometimes payment from an outside attacker. Examples include an employee copying a customer list before resigning, a contractor selling database access to a third party, or current staff knowingly handing over login credentials.<\/li>\n<\/ul>\n\n\n\n
Malicious insiders are becoming a serious threat to data integrity. The Identity Theft Resource Center recorded a sevenfold increase in malicious insider incidents in the first half of 2026.2<\/sup><\/p>\n\n\n\nExternal Threats<\/h3>\n\n\n\n
An external threat comes from someone who has to break in, trick their way in, or find a virtual door that\u2019s been left open.<\/strong> These include:<\/p>\n\n\n\n\n- Social engineering<\/strong><\/a>:<\/strong> Attackers manipulate a person into handing over credentials or access. Phishing emails are the classic version, though voice calls and text messages are growing in popularity. For instance, Verizon found mobile-based lures had a 40% higher success rate in phishing simulations.3<\/sup><\/li>\n\n\n\n
- Malware, ransomware, and spyware<\/strong><\/a>:<\/strong> Malicious software that steals data, encrypts it for ransom, or monitors activity quietly. Information-stealing malware harvests saved passwords from infected machines, after which those credentials can be resold.<\/li>\n\n\n\n
- Vulnerability exploits:<\/strong> Attackers target known flaws in software that haven\u2019t been patched. Thanks to improving AI capabilities, vulnerability exploits are now the most common way to gain access to data, accounting for 31% of all breaches.3<\/sup><\/li>\n\n\n\n
- Exposed cloud storage and misconfigured services:<\/strong> Attackers scan the internet for storage buckets, databases, and admin panels left reachable without authentication. <\/li>\n\n\n\n
- SQL injection:<\/strong> Attackers type database commands into a website\u2019s input fields (e.g. a search box or login form). If the site passes that text straight to its database, the database answers.<\/li>\n\n\n\n
- Device theft:<\/strong> A stolen laptop, phone, or drive gives an attacker almost instant access to whatever data is on it or that it provides access to.<\/li>\n\n\n\n
- Third-party and supply chain compromise:<\/strong> Attackers breach a vendor, then use that trusted connection to reach its customers. Breaches involving a third party accounted for 48% of the total in Verizon\u2019s 2026 Data Breach Investigations Report.3<\/sup><\/li>\n<\/ul>\n\n\n\n
The 4-Step Process of Malicious Data Breaches<\/h2>\n\n\n\n
Malicious breaches tend to follow the same four steps. Although cybercriminals take more-or-less the same approach every time, this doesn\u2019t necessarily make attacks easy to identify. According to IBM\u2019s Cost of a Data Breach Report 2026, the average breach lifecycle is 247 days, with 183 to detect the intrusion and 64 more to contain it.4<\/sup><\/p>\n\n\n\nHere\u2019s the process:<\/p>\n\n\n\n
\n- Research: <\/strong>The attacker studies the target to find the most likely point for gaining entry. That might be a person, a system, or a vendor with a connection to the network.<\/li>\n\n\n\n
- Attack: <\/strong>The attacker uses that weakness to get access. This can be done with phishing messages, zero-day attacks, or other methods.<\/li>\n\n\n\n
- Extraction:<\/strong> With access established, the attacker locates the valuable data, copies it, and may even encrypt files in place so that the target organization can\u2019t access it.<\/li>\n\n\n\n
- Exploitation:<\/strong> The data gets monetized. It\u2019s sold or traded (usually on the dark web<\/a>), used directly for fraud, or used to extort the victim organization.<\/li>\n<\/ol>\n\n\n\n
The Effects of Data Breaches<\/h2>\n\n\n\n
A breach unfortunately doesn\u2019t end when the intrusion is contained. For individuals, exposed data circulates indefinitely. For the organization, the costs, the legal exposure, and the loss of customer confidence can run for years.<\/p>\n\n\n\n
Exposure of Identifying Information and Other Data\u00a0<\/h3>\n\n\n\n
Once your personally identifiable information is exposed, it\u2019s exposed. There\u2019s no recall mechanism. Your name, date of birth, address, Social Security number, and other important information can sit in a dataset that gets recompiled, resold, and merged with other breach data for years.<\/strong><\/p>\n\n\n\nThe practical effect of this is that attacks against you get more convincing. Someone who knows your recent order history, your insurer, and your partner\u2019s name, for example, can write a message that survives your skepticism. Credential stuffing<\/a> works on the same principle: Reused passwords from one breach can be used to unlock accounts elsewhere.<\/p>\n\n\n\nFinancial and Operational Costs\u00a0<\/h3>\n\n\n\n
The global average cost of a data breach reached $4.99 million in 2025, <\/strong>with breach detection as well as escalation and lost business making up a big portion of this expense.3<\/sup><\/p>\n\n\n\nThat said, the total is made up of the sum of a long list of separate costs. Investigation, legal fees, notification, loss of business, and regulatory fines<\/strong> are all bundled into the number, which means that it can be highly variable depending on the strength of a business\u2019s security, breach detection, and remediation systems.\u00a0<\/p>\n\n\n\nOperational costs add to the financial burden of a data breach.<\/strong> These attacks have the potential to cause systems to go offline and redirect staff time and attention to remedying the breach, rather than focusing on their actual jobs.<\/p>\n\n\n\nReputational Damage<\/h3>\n\n\n\n
Customers choosing not to do business with an organization<\/strong> accounts for a large share of what a breach costs. And it\u2019s the most difficult effect to reverse.<\/p>\n\n\n\nA breach might suggest that the company either didn\u2019t invest in protecting the data it collected or didn\u2019t notice when someone took it.<\/strong> Both of which are reasons why customers might choose to work with a competitor.<\/p>\n\n\n\nThis damage can also affect a business\u2019s ability to attract new customers.<\/strong> For example, corporate buyers run security reviews before signing contracts and those reviews ask directly whether a vendor has been breached. These incidents have to be disclosed, which could give the buyer the upper hand in a negotiation or a reason to work with a competitor instead.<\/p>\n\n\n\nLegal Liability\u00a0<\/h3>\n\n\n\n
Companies that hold data have various obligations under data protection laws and regulations. <\/strong>They are required to secure the information, notify people when that fails, and be able to show the safeguards were reasonable. Falling short on any of those is a violation in itself, separate from the breach.<\/strong><\/p>\n\n\n\nWhich obligations an entity has to fulfill depends on the data being held and the place where the company operates or stores this information.\u00a0<\/p>\n\n\n\n
For example, the General Data Protection Regulation (GDPR) covers European Union residents and allows fines up to \u20ac20 million or 4% of global annual turnover for data incidents. In the same vein, California\u2019s Consumer Privacy Rights Act (CPRA) gives state residents enforceable rights and sets out fines for failure to protect these rights.<\/p>\n\n\n\n
These regulations give affected individuals a right to compensation, which can be crippling to an organization that suffers a large breach.<\/strong><\/p>\n\n\n\nWhy Do People Steal Data?<\/h2>\n\n\n\n![\"Data](\"https:\/\/www.privateinternetaccess.com\/blog\/wp-content\/uploads\/2026\/08\/The-Price-of-Stolen-Data-on-the-Dark-Web-1024x969.png\")
<\/figure>\n\n\n\nThe answer to this question is generally straightforward: Money. There\u2019s a huge market for stolen records and the prices tell you what attackers actually want.<\/strong><\/p>\n\n\n\nThreat intelligence firm Flare analyzed 348 real breach listings from dark web marketplaces and found health records at the top, selling for roughly $300 each.<\/strong>1<\/sup>\u00a0<\/strong><\/p>\n\n\n\nPersonal identification numbers followed in second place at $196, bank account numbers at $69, driver\u2019s licenses at $68, and passport numbers at $33. Credit card numbers ranked ninth, at $18, while email addresses went for under a dollar.<\/p>\n\n\n\n
There are two reasons for this ranking. For one, data that can\u2019t be changed is more valuable to cybercriminals<\/strong> as it can allow prolonged access to various other tranches of data. You can easily cancel a credit card, but you can\u2019t get a new Social Security number.<\/p>\n\n\n\nSecondly, different types of data enable different crimes that have varying financial perks.<\/strong> Financial details fund direct theft. Personally identifiable information enables identity and credit fraud. Health records feed insurance fraud. And employee records, criminal histories, and biometric data serve blackmail and targeted social engineering.<\/p>\n\n\n\nData Breach Prevention: How to Keep Your Data Secure<\/h2>\n\n\n\n
Best practices to prevent a data breach depend on which side of the data dynamic you\u2019re on. <\/strong>As businesses generally hold the data, they carry most of the responsibility for protecting it. Individuals play a smaller role, but there are strategies you can use to make yourself a harder target and limit what information an attacker can get hold of.<\/p>\n\n\n\nData Breach Protection for Organizations<\/h3>\n\n\n\n
Preventing a data breach usually means layering controls so no single failure leads to total exposure. <\/strong>Organizations use a combination of the following defences for data breach protection:<\/p>\n\n\n\n\n- Data classification:<\/strong> Cataloging data to get a full picture of what information the organization holds, how sensitive it is, and where it lives on the system.<\/li>\n\n\n\n
- Firewalls<\/strong><\/a>:<\/strong> Filtering traffic at the network boundary and between internal segments, so access to one system doesn\u2019t enable access to the rest.<\/li>\n\n\n\n
- Encryption:<\/strong> Encrypting data<\/a> at rest and in transit ensures that it\u2019s unreadable \u2013 and therefore useless \u2013 to any unauthorized persons who might access it without decryption keys.<\/li>\n\n\n\n
- Physical security:<\/strong> Controlling who can physically reach servers, workstations, and printed records, through locked server rooms, badge access, and clean-desk policies.<\/li>\n\n\n\n
- Cloud security services:<\/strong> Monitoring cloud configuration for the errors that cause most cloud exposure (e.g. public storage buckets and over-permissive access roles).<\/li>\n\n\n\n
- Employee training:<\/strong> Teaching staff to recognize phishing<\/a>, voice phishing, and pretexting attempts, and giving them a reliable way to report a suspected issue.<\/li>\n\n\n\n
- Identity and access management:<\/strong> Granting each role the minimum access it needs, enforcing multi-factor authentication<\/a>, and revoking credentials when someone leaves. <\/li>\n<\/ul>\n\n\n\n
How Individuals Can Prevent a Data Breach<\/h3>\n\n\n\n
You can\u2019t prevent a data breach at a company that holds your data, but you can limit how much information gained from one breach can be used elsewhere. <\/strong>There are three simple steps to take here:<\/p>\n\n\n\n\n- Use strong, unique passwords:<\/strong> One password per account, generated and stored by a password manager. <\/li>\n\n\n\n
- Enable multi-factor authentication:<\/strong> Adding a second authentication factor (like biometrics or app authentication) can block an attacker who already has your password.<\/li>\n\n\n\n
- Be skeptical about calls and emails:<\/strong> Treat unexpected requests for credentials, payment details, or verification codes as suspicious, no matter who the sender appears to be. Contact the organization using a number or address you already have, not one supplied in the message.<\/li>\n<\/ul>\n\n\n\n
How to Check if Your Data Has Been Exposed<\/h2>\n\n\n\n
There\u2019s a golden rule of digital data privacy: Assume that some of your data is already out there, but take precautions to secure it as though it isn\u2019t.<\/strong><\/p>\n\n\n\nWebsites like <\/strong>Have I Been Pwned<\/strong><\/a> let you enter an email address and see which known breaches include it. Running the check takes seconds and tells you which accounts need attention first.<\/p>\n\n\n\nBreach notification letters are the other signal.<\/strong> A notice will likely name the data categories involved, the dates of the intrusion, and the steps the organization is taking to remedy the issue. All of which can help you to understand what you need to do to further secure your data.<\/p>\n\n\n\nThen there are more subtle signs, like receiving an unusual amount of spam calls or emails, or unusual movements on your bank accounts or credit score.<\/strong> All of these can point to the fact that your data has been exposed in a breach and cybercriminals are using it to their benefit.<\/p>\n\n\n\nWhat to Do if Your Data Has Been Compromised in a Cybersecurity Breach<\/h2>\n\n\n\n
You should be notified when an organization loses your data, though the letter or email may arrive long after the fact. It\u2019s best to take immediate action if you think your data may have been exposed.<\/strong><\/p>\n\n\n\nManage Your Passwords<\/h3>\n\n\n\n
Change the password on the breached account first, then anywhere you reused it. <\/strong>Using a password manager makes this a little easier. It generates unique passwords, stores them, and flags which of your logins are duplicates so you can resolve them.\u00a0<\/p>\n\n\n\nWhere the service you\u2019re using supports passkeys, switch.<\/strong> A passkey keeps a private key on your device that never gets sent anywhere, so there\u2019s nothing to be accessed or phished by an attacker.<\/p>\n\n\n\nMonitor Your Finances\u00a0<\/h3>\n\n\n\n
Check your bank and credit card statements line by line for small unfamiliar charges. <\/strong>Attackers often make low-value purchases before they really dig in to test whether a card is live and whether you\u2019ll notice the charge.<\/p>\n\n\n\nIt\u2019s also a good idea to check your credit report regularly, looking for any new accounts that you don\u2019t remember opening. <\/strong>You should continue to do this for at least 12 months after a breach, and perform random spot checks every couple of months thereafter.\u00a0<\/p>\n\n\n\nInitiate a Fraud Alert\u00a0<\/h3>\n\n\n\n
Contact one or all of the credit bureaus that operate in the country where you are to create a fraud alert.<\/strong> This is a free notification that requires lenders to verify your identity before opening credit in your name.\u00a0<\/p>\n\n\n\nA credit freeze is another option, <\/strong>though it blocks access to your file entirely so you\u2019ll need to lift it when next you want to apply for credit.<\/p>\n\n\n\nExamples of Major Data Breaches<\/h2>\n\n\n\n
Any organization can fall victim to a data breach \u2013 giants like Meta, X (Twitter), Yahoo, eBay, Adobe, Target, Uber, and AT&T have all been at the center of major breaches in the past. Below are five recent data breach incidents that illustrate how these events happen and the effects they have.<\/p>\n\n\n\n![\"Five](\"https:\/\/www.privateinternetaccess.com\/blog\/wp-content\/uploads\/2026\/08\/Five-Major-Data-Breaches-955x1024.png\")
<\/figure>\n\n\n\nConduent<\/h3>\n\n\n\n\n- Date of breach: <\/strong>October 21, 2024 to January 13, 2025 (disclosed in April 2025).<\/li>\n\n\n\n
- Number of records affected:<\/strong> 62,224,658<\/li>\n\n\n\n
- Attack vector: <\/strong>Ransomware intrusion claimed by the SafePay group<\/li>\n\n\n\n
- Data exposed:<\/strong> Names, Social Security numbers, dates of birth, addresses, health insurance information, and in some cases medical treatment and claims data<\/li>\n<\/ul>\n\n\n\n
Conduent is a business services provider most people have probably never heard of. It handles payments and administration for state Medicaid programs, child support systems, food assistance, and large health insurers across more than 30 US states.\u00a0<\/p>\n\n\n\n
Attackers spent nearly three months inside the network before anyone noticed and took around 8 terabytes of data, taking the number of victims from about 10.5 million in the initial assessment to 25.5 million in February 2026, and a final 62,224,658 in June 2026.5<\/sup><\/p>\n\n\n\nThe worst part of this attack is that almost none of the people who were affected chose to give Conduent their information.<\/p>\n\n\n\n
23andMe<\/h3>\n\n\n\n\n- Date of breach:<\/strong> April to September 2023 (disclosed in October 2023)<\/li>\n\n\n\n
- Number of records affected: <\/strong>6.9 million<\/li>\n\n\n\n
- Attack vector:<\/strong> Credential stuffing<\/li>\n\n\n\n
- Data exposed: <\/strong>Names, birth years, self-reported locations, profile photos, family trees, ethnicity estimates, and health predisposition reports<\/li>\n<\/ul>\n\n\n\n
Attackers in this data breach tested passwords stolen from other websites to gain access to roughly 14,000 accounts where those keys were reused. They then used 23andMe\u2019s family-matching features to reach highly sensitive data belonging to 6.9 million people.6<\/sup><\/p>\n\n\n\nThe company dismissed early public reports as a hoax and only confirmed the breach after an employee found the data for sale on Reddit.\u00a0<\/p>\n\n\n\n
Regulators found that 23andMe had not required multi-factor authentication and had not checked customer passwords against lists of credentials already known to be compromised \u2013 two simple measures that could have blocked the attack. The UK\u2019s Information Commissioner\u2019s Office fined the company \u00a32.31 million as a result, contributing to the business\u2019s 2025 bankruptcy.<\/p>\n\n\n\n
Salesforce\u00a0<\/h3>\n\n\n\n\n- Date of breach: <\/strong>August 8 to 18, 2025<\/li>\n\n\n\n
- Organizations affected: <\/strong>700+<\/li>\n\n\n\n
- Attack vector: <\/strong>Stolen OAuth tokens belonging to a third-party integration<\/li>\n\n\n\n
- Data exposed:<\/strong> Salesforce support case text, contact and account records, and credentials customers had stored inside those records<\/li>\n<\/ul>\n\n\n\n
Over ten days in August 2025, attackers later identified by Google as UNC6395 queried and exported data from more than 700 organizations, including Cloudflare, Google, Palo Alto Networks, Proofpoint, Tanium, and Zscaler.7<\/sup>\u00a0<\/p>\n\n\n\nThey were hunting credentials that customers had pasted into support tickets: Amazon Web Services access keys, Snowflake tokens, and plaintext passwords.<\/p>\n\n\n\n
Salesforce wasn\u2019t attacked directly \u2013 the data thieves exploited an OAuth vulnerability that allowed third-party app Salesloft to query Salesforce on a customer\u2019s behalf. Using this route allowed attackers to bypass passwords and multi-factor authentication entirely.8<\/sup><\/p>\n\n\n\nTicketmaster (Snowflake)<\/h3>\n\n\n\n\n- Date of breach:<\/strong> April to May 2024 (disclosed in May 2024)<\/li>\n\n\n\n
- Number of records affected: <\/strong>560 million claimed by attackers; unconfirmed by Ticketmaster<\/li>\n\n\n\n
- Attack vector:<\/strong> Stolen credentials for a third-party cloud data warehouse account with no multi-factor authentication<\/li>\n\n\n\n
- Data exposed:<\/strong> Names, addresses, email addresses, phone numbers, order details, and partial payment card data<\/li>\n<\/ul>\n\n\n\n
In this breach, attackers obtained credentials for Ticketmaster\u2019s account with Snowflake (a cloud data warehousing provider) using logins harvested by information-stealing malware from infected machines.9<\/sup>\u00a0<\/p>\n\n\n\nThe account had no multi-factor authentication enabled, so the stolen password was all attackers needed to gain access. Although Snowflake\u2019s own systems weren\u2019t breached, around 165 Snowflake customer organizations were affected as a result.<\/p>\n\n\n\n
The total number of records affected has never been confirmed by Ticketmaster, though attackers claim to have accessed 560 million. It\u2019s difficult to tell how much data was stolen, but attackers did offer 1.3 terabytes of data for sale at $500,000 by the end of May 2024.10<\/sup>\u00a0<\/p>\n\n\n\nSoundcloud<\/h3>\n\n\n\n\n- Date of breach: <\/strong>Detected December 2025 (disclosed January 2026)<\/li>\n\n\n\n
- Number of records affected: <\/strong>29.8 million user accounts<\/li>\n\n\n\n
- Attack vector: <\/strong>Unauthorized access to an internal staff dashboard<\/li>\n\n\n\n
- Data exposed:<\/strong> Email addresses, names, usernames, display names, profile images, follower counts, and country (in some cases)<\/li>\n<\/ul>\n\n\n\n
The attackers behind this breach never had to touch SoundCloud\u2019s main user database to gain access to the 29.8 million user accounts they targeted. Rather, they accessed an internal dashboard used by staff and used it to link private email addresses to public profile data, building a dataset that connected identities to contact details at scale.<\/p>\n\n\n\n
Although no passwords were stolen in this breach, the fact that email addresses were tied to verified usernames, follower counts, and location data still gave attackers enough material for convincing targeted phishing.\u00a0<\/p>\n\n\n\n
Data Breach FAQs<\/h2>\n\n\n\nWhat are the most common causes of data breaches?<\/h3>
Unpatched software vulnerabilities are now the leading data breach threats<\/a>, making 31% of breaches according to Verizon. Stolen credentials, phishing, cloud misconfigurations, and insider mistakes make up most of the rest. Third parties were involved in nearly half of all breaches.
<\/p> <\/div> How can you prevent a data breach for a company and individual?<\/h3>
There are plenty of strategies to prevent data breaches<\/a>. Businesses should invest in data classification, encryption at rest and in transit, least-privilege access, multi-factor authentication, and staff training. Individuals should use unique passwords from a password manager, turn on multi-factor authentication, and freeze their credit files.
<\/p> <\/div> What should you do immediately after a data breach?<\/h3>
If you find out that your data has been exposed<\/a>, immediately change the password on the affected account and anywhere you reused it, then enable multi-factor authentication. Place a one-year fraud alert with any one of the three credit bureaus, or freeze your credit for more protection.
<\/p> <\/div> What is the difference between a data breach and a cybersecurity breach?<\/h3>
In everyday use, none. Both describe unauthorized access to systems or information<\/a>. That said, cybersecurity breach tends to emphasize the security failure and can cover incidents where no data moved, while data breach specifies that information was exposed.
<\/p> <\/div> Can a VPN help reduce the risk of data breaches?<\/h3>
Not directly. A VPN can\u2019t protect data sitting on a company\u2019s servers, which is where nearly every major breach happens. It does hide your IP address and encrypt your traffic<\/a> as it flows between your device and the VPN server, which can help prevent your data being intercepted and stolen by others on your network.
<\/p> <\/div> <\/div>\n\n\n\nReferences:<\/strong><\/p>\n\n\n\n1. What is the Cost of Your Data on the Dark Web? \u2013 Flare<\/a>
2. ITRC: Malicious Insiders Surge as H1 2026 Data Compromises Set Pace for Record Year \u2013 Identity Theft Resource Centre<\/a>
3. Vulnerability exploitation top breach entry point, 2026 industry-wide DBIR finds \u2013 Verizon<\/a>
4. Cost of a Data Breach Report 2026 \u2013 IBM<\/a>
5. Conduent Business Services Data Breach Affected More Than 62.2 Million Individuals \u2013 The HIPAA Journal<\/a>
6. 23andMe Data Breach: What Was Exposed, Who Was Affected, and What Happens to Your DNA Now \u2013 <\/a>Security.org<\/a>
7. Reviewing the Salesforce\u2013Salesloft Drift OAuth Supply Chain Breach \u2013 Anomali<\/a>
8. Salesloft breached to steal OAuth tokens for Salesforce data-theft attacks \u2013 TechRadar<\/a>
9. Snowflake Data Breach \u2013 Huntress<\/a>
10. Data allegedly stolen from 560 million Ticketmaster users \u2013 BBC<\/a>
11. Have I Been Pwned: SoundCloud data breach impacts 29.8 million accounts \u2013 BleepingComputer<\/a><\/p>\n\n\n\n","protected":false},"excerpt":{"rendered":"
Whether it\u2019s called a cybersecurity breach, a security breach, a data compromise, or a data spill, a data breach always results in information ending up in the hands of people who were never authorized to see it.<\/p>\n\n\n\n
It\u2019s good to keep in mind that someone doesn\u2019t necessarily have to steal data for a breach to occur. Unauthorized access on its own is enough<\/strong> \u2013 even if nothing gets copied \u2013 as is losing track of data you\u2019re responsible for.\u00a0<\/p>\n\n\n\n For example, a contractor who opens patient files they have no business reading causes a breach. So does an organization that can\u2019t account for where a set of records went. Nobody profited in either case, but the data is still compromised.<\/p>\n\n\n\n Breaches can be described by the kind of data involved. The most common types are:<\/p>\n\n\n\n Breaches start either inside an organization or outside of it.<\/strong> Insiders usually have access to at least some data and can either misuse it or make a mistake with it. External attackers have to find a way in first, and they have plenty of tactics for doing that.<\/p>\n\n\n\n An insider breach involves someone who already has legitimate access to the data,<\/strong> whether that\u2019s an employee, a contractor, or a vendor with valid credentials to access an organization\u2019s systems. No perimeter gets crossed,<\/strong> which is part of what makes these breaches hard to identify.<\/p>\n\n\n\n There are two broad types of insider breaches:<\/p>\n\n\n\n Malicious insiders are becoming a serious threat to data integrity. The Identity Theft Resource Center recorded a sevenfold increase in malicious insider incidents in the first half of 2026.2<\/sup><\/p>\n\n\n\n An external threat comes from someone who has to break in, trick their way in, or find a virtual door that\u2019s been left open.<\/strong> These include:<\/p>\n\n\n\n Malicious breaches tend to follow the same four steps. Although cybercriminals take more-or-less the same approach every time, this doesn\u2019t necessarily make attacks easy to identify. According to IBM\u2019s Cost of a Data Breach Report 2026, the average breach lifecycle is 247 days, with 183 to detect the intrusion and 64 more to contain it.4<\/sup><\/p>\n\n\n\n Here\u2019s the process:<\/p>\n\n\n\n A breach unfortunately doesn\u2019t end when the intrusion is contained. For individuals, exposed data circulates indefinitely. For the organization, the costs, the legal exposure, and the loss of customer confidence can run for years.<\/p>\n\n\n\n Once your personally identifiable information is exposed, it\u2019s exposed. There\u2019s no recall mechanism. Your name, date of birth, address, Social Security number, and other important information can sit in a dataset that gets recompiled, resold, and merged with other breach data for years.<\/strong><\/p>\n\n\n\n The practical effect of this is that attacks against you get more convincing. Someone who knows your recent order history, your insurer, and your partner\u2019s name, for example, can write a message that survives your skepticism. Credential stuffing<\/a> works on the same principle: Reused passwords from one breach can be used to unlock accounts elsewhere.<\/p>\n\n\n\n The global average cost of a data breach reached $4.99 million in 2025, <\/strong>with breach detection as well as escalation and lost business making up a big portion of this expense.3<\/sup><\/p>\n\n\n\n That said, the total is made up of the sum of a long list of separate costs. Investigation, legal fees, notification, loss of business, and regulatory fines<\/strong> are all bundled into the number, which means that it can be highly variable depending on the strength of a business\u2019s security, breach detection, and remediation systems.\u00a0<\/p>\n\n\n\n Operational costs add to the financial burden of a data breach.<\/strong> These attacks have the potential to cause systems to go offline and redirect staff time and attention to remedying the breach, rather than focusing on their actual jobs.<\/p>\n\n\n\n Customers choosing not to do business with an organization<\/strong> accounts for a large share of what a breach costs. And it\u2019s the most difficult effect to reverse.<\/p>\n\n\n\n A breach might suggest that the company either didn\u2019t invest in protecting the data it collected or didn\u2019t notice when someone took it.<\/strong> Both of which are reasons why customers might choose to work with a competitor.<\/p>\n\n\n\n This damage can also affect a business\u2019s ability to attract new customers.<\/strong> For example, corporate buyers run security reviews before signing contracts and those reviews ask directly whether a vendor has been breached. These incidents have to be disclosed, which could give the buyer the upper hand in a negotiation or a reason to work with a competitor instead.<\/p>\n\n\n\n Companies that hold data have various obligations under data protection laws and regulations. <\/strong>They are required to secure the information, notify people when that fails, and be able to show the safeguards were reasonable. Falling short on any of those is a violation in itself, separate from the breach.<\/strong><\/p>\n\n\n\n Which obligations an entity has to fulfill depends on the data being held and the place where the company operates or stores this information.\u00a0<\/p>\n\n\n\n For example, the General Data Protection Regulation (GDPR) covers European Union residents and allows fines up to \u20ac20 million or 4% of global annual turnover for data incidents. In the same vein, California\u2019s Consumer Privacy Rights Act (CPRA) gives state residents enforceable rights and sets out fines for failure to protect these rights.<\/p>\n\n\n\n These regulations give affected individuals a right to compensation, which can be crippling to an organization that suffers a large breach.<\/strong><\/p>\n\n\n\n The answer to this question is generally straightforward: Money. There\u2019s a huge market for stolen records and the prices tell you what attackers actually want.<\/strong><\/p>\n\n\n\n Threat intelligence firm Flare analyzed 348 real breach listings from dark web marketplaces and found health records at the top, selling for roughly $300 each.<\/strong>1<\/sup>\u00a0<\/strong><\/p>\n\n\n\n Personal identification numbers followed in second place at $196, bank account numbers at $69, driver\u2019s licenses at $68, and passport numbers at $33. Credit card numbers ranked ninth, at $18, while email addresses went for under a dollar.<\/p>\n\n\n\n There are two reasons for this ranking. For one, data that can\u2019t be changed is more valuable to cybercriminals<\/strong> as it can allow prolonged access to various other tranches of data. You can easily cancel a credit card, but you can\u2019t get a new Social Security number.<\/p>\n\n\n\n Secondly, different types of data enable different crimes that have varying financial perks.<\/strong> Financial details fund direct theft. Personally identifiable information enables identity and credit fraud. Health records feed insurance fraud. And employee records, criminal histories, and biometric data serve blackmail and targeted social engineering.<\/p>\n\n\n\n Best practices to prevent a data breach depend on which side of the data dynamic you\u2019re on. <\/strong>As businesses generally hold the data, they carry most of the responsibility for protecting it. Individuals play a smaller role, but there are strategies you can use to make yourself a harder target and limit what information an attacker can get hold of.<\/p>\n\n\n\n Preventing a data breach usually means layering controls so no single failure leads to total exposure. <\/strong>Organizations use a combination of the following defences for data breach protection:<\/p>\n\n\n\n You can\u2019t prevent a data breach at a company that holds your data, but you can limit how much information gained from one breach can be used elsewhere. <\/strong>There are three simple steps to take here:<\/p>\n\n\n\n There\u2019s a golden rule of digital data privacy: Assume that some of your data is already out there, but take precautions to secure it as though it isn\u2019t.<\/strong><\/p>\n\n\n\n Websites like <\/strong>Have I Been Pwned<\/strong><\/a> let you enter an email address and see which known breaches include it. Running the check takes seconds and tells you which accounts need attention first.<\/p>\n\n\n\n Breach notification letters are the other signal.<\/strong> A notice will likely name the data categories involved, the dates of the intrusion, and the steps the organization is taking to remedy the issue. All of which can help you to understand what you need to do to further secure your data.<\/p>\n\n\n\n Then there are more subtle signs, like receiving an unusual amount of spam calls or emails, or unusual movements on your bank accounts or credit score.<\/strong> All of these can point to the fact that your data has been exposed in a breach and cybercriminals are using it to their benefit.<\/p>\n\n\n\n You should be notified when an organization loses your data, though the letter or email may arrive long after the fact. It\u2019s best to take immediate action if you think your data may have been exposed.<\/strong><\/p>\n\n\n\n Change the password on the breached account first, then anywhere you reused it. <\/strong>Using a password manager makes this a little easier. It generates unique passwords, stores them, and flags which of your logins are duplicates so you can resolve them.\u00a0<\/p>\n\n\n\n Where the service you\u2019re using supports passkeys, switch.<\/strong> A passkey keeps a private key on your device that never gets sent anywhere, so there\u2019s nothing to be accessed or phished by an attacker.<\/p>\n\n\n\n Check your bank and credit card statements line by line for small unfamiliar charges. <\/strong>Attackers often make low-value purchases before they really dig in to test whether a card is live and whether you\u2019ll notice the charge.<\/p>\n\n\n\n It\u2019s also a good idea to check your credit report regularly, looking for any new accounts that you don\u2019t remember opening. <\/strong>You should continue to do this for at least 12 months after a breach, and perform random spot checks every couple of months thereafter.\u00a0<\/p>\n\n\n\n Contact one or all of the credit bureaus that operate in the country where you are to create a fraud alert.<\/strong> This is a free notification that requires lenders to verify your identity before opening credit in your name.\u00a0<\/p>\n\n\n\n A credit freeze is another option, <\/strong>though it blocks access to your file entirely so you\u2019ll need to lift it when next you want to apply for credit.<\/p>\n\n\n\n Any organization can fall victim to a data breach \u2013 giants like Meta, X (Twitter), Yahoo, eBay, Adobe, Target, Uber, and AT&T have all been at the center of major breaches in the past. Below are five recent data breach incidents that illustrate how these events happen and the effects they have.<\/p>\n\n\n\n Conduent is a business services provider most people have probably never heard of. It handles payments and administration for state Medicaid programs, child support systems, food assistance, and large health insurers across more than 30 US states.\u00a0<\/p>\n\n\n\n Attackers spent nearly three months inside the network before anyone noticed and took around 8 terabytes of data, taking the number of victims from about 10.5 million in the initial assessment to 25.5 million in February 2026, and a final 62,224,658 in June 2026.5<\/sup><\/p>\n\n\n\n The worst part of this attack is that almost none of the people who were affected chose to give Conduent their information.<\/p>\n\n\n\n Attackers in this data breach tested passwords stolen from other websites to gain access to roughly 14,000 accounts where those keys were reused. They then used 23andMe\u2019s family-matching features to reach highly sensitive data belonging to 6.9 million people.6<\/sup><\/p>\n\n\n\n The company dismissed early public reports as a hoax and only confirmed the breach after an employee found the data for sale on Reddit.\u00a0<\/p>\n\n\n\n Regulators found that 23andMe had not required multi-factor authentication and had not checked customer passwords against lists of credentials already known to be compromised \u2013 two simple measures that could have blocked the attack. The UK\u2019s Information Commissioner\u2019s Office fined the company \u00a32.31 million as a result, contributing to the business\u2019s 2025 bankruptcy.<\/p>\n\n\n\n Over ten days in August 2025, attackers later identified by Google as UNC6395 queried and exported data from more than 700 organizations, including Cloudflare, Google, Palo Alto Networks, Proofpoint, Tanium, and Zscaler.7<\/sup>\u00a0<\/p>\n\n\n\n They were hunting credentials that customers had pasted into support tickets: Amazon Web Services access keys, Snowflake tokens, and plaintext passwords.<\/p>\n\n\n\n Salesforce wasn\u2019t attacked directly \u2013 the data thieves exploited an OAuth vulnerability that allowed third-party app Salesloft to query Salesforce on a customer\u2019s behalf. Using this route allowed attackers to bypass passwords and multi-factor authentication entirely.8<\/sup><\/p>\n\n\n\n In this breach, attackers obtained credentials for Ticketmaster\u2019s account with Snowflake (a cloud data warehousing provider) using logins harvested by information-stealing malware from infected machines.9<\/sup>\u00a0<\/p>\n\n\n\n The account had no multi-factor authentication enabled, so the stolen password was all attackers needed to gain access. Although Snowflake\u2019s own systems weren\u2019t breached, around 165 Snowflake customer organizations were affected as a result.<\/p>\n\n\n\n The total number of records affected has never been confirmed by Ticketmaster, though attackers claim to have accessed 560 million. It\u2019s difficult to tell how much data was stolen, but attackers did offer 1.3 terabytes of data for sale at $500,000 by the end of May 2024.10<\/sup>\u00a0<\/p>\n\n\n\n The attackers behind this breach never had to touch SoundCloud\u2019s main user database to gain access to the 29.8 million user accounts they targeted. Rather, they accessed an internal dashboard used by staff and used it to link private email addresses to public profile data, building a dataset that connected identities to contact details at scale.<\/p>\n\n\n\n Although no passwords were stolen in this breach, the fact that email addresses were tied to verified usernames, follower counts, and location data still gave attackers enough material for convincing targeted phishing.\u00a0<\/p>\n\n\n\n Unpatched software vulnerabilities are now the leading data breach threats<\/a>, making 31% of breaches according to Verizon. Stolen credentials, phishing, cloud misconfigurations, and insider mistakes make up most of the rest. Third parties were involved in nearly half of all breaches. There are plenty of strategies to prevent data breaches<\/a>. Businesses should invest in data classification, encryption at rest and in transit, least-privilege access, multi-factor authentication, and staff training. Individuals should use unique passwords from a password manager, turn on multi-factor authentication, and freeze their credit files. If you find out that your data has been exposed<\/a>, immediately change the password on the affected account and anywhere you reused it, then enable multi-factor authentication. Place a one-year fraud alert with any one of the three credit bureaus, or freeze your credit for more protection. In everyday use, none. Both describe unauthorized access to systems or information<\/a>. That said, cybersecurity breach tends to emphasize the security failure and can cover incidents where no data moved, while data breach specifies that information was exposed. Not directly. A VPN can\u2019t protect data sitting on a company\u2019s servers, which is where nearly every major breach happens. It does hide your IP address and encrypt your traffic<\/a> as it flows between your device and the VPN server, which can help prevent your data being intercepted and stolen by others on your network. References:<\/strong><\/p>\n\n\n\n 1. What is the Cost of Your Data on the Dark Web? \u2013 Flare<\/a>Types of Data Breaches<\/h3>\n\n\n\n
\n
How Does a Data Breach Happen?<\/h2>\n\n\n\n
<\/figure>\n\n\n\nInsider Breaches<\/h3>\n\n\n\n
\n
External Threats<\/h3>\n\n\n\n
\n
The 4-Step Process of Malicious Data Breaches<\/h2>\n\n\n\n
\n
The Effects of Data Breaches<\/h2>\n\n\n\n
Exposure of Identifying Information and Other Data\u00a0<\/h3>\n\n\n\n
Financial and Operational Costs\u00a0<\/h3>\n\n\n\n
Reputational Damage<\/h3>\n\n\n\n
Legal Liability\u00a0<\/h3>\n\n\n\n
Why Do People Steal Data?<\/h2>\n\n\n\n
<\/figure>\n\n\n\nData Breach Prevention: How to Keep Your Data Secure<\/h2>\n\n\n\n
Data Breach Protection for Organizations<\/h3>\n\n\n\n
\n
How Individuals Can Prevent a Data Breach<\/h3>\n\n\n\n
\n
How to Check if Your Data Has Been Exposed<\/h2>\n\n\n\n
What to Do if Your Data Has Been Compromised in a Cybersecurity Breach<\/h2>\n\n\n\n
Manage Your Passwords<\/h3>\n\n\n\n
Monitor Your Finances\u00a0<\/h3>\n\n\n\n
Initiate a Fraud Alert\u00a0<\/h3>\n\n\n\n
Examples of Major Data Breaches<\/h2>\n\n\n\n
<\/figure>\n\n\n\nConduent<\/h3>\n\n\n\n
\n
23andMe<\/h3>\n\n\n\n
\n
Salesforce\u00a0<\/h3>\n\n\n\n
\n
Ticketmaster (Snowflake)<\/h3>\n\n\n\n
\n
Soundcloud<\/h3>\n\n\n\n
\n
Data Breach FAQs<\/h2>\n\n\n\n
What are the most common causes of data breaches?<\/h3>
<\/p> <\/div> How can you prevent a data breach for a company and individual?<\/h3>
<\/p> <\/div> What should you do immediately after a data breach?<\/h3>
<\/p> <\/div> What is the difference between a data breach and a cybersecurity breach?<\/h3>
<\/p> <\/div> Can a VPN help reduce the risk of data breaches?<\/h3>
<\/p> <\/div> <\/div>\n\n\n\n
2. ITRC: Malicious Insiders Surge as H1 2026 Data Compromises Set Pace for Record Year \u2013 Identity Theft Resource Centre<\/a>
3. Vulnerability exploitation top breach entry point, 2026 industry-wide DBIR finds \u2013 Verizon<\/a>
4. Cost of a Data Breach Report 2026 \u2013 IBM<\/a>
5. Conduent Business Services Data Breach Affected More Than 62.2 Million Individuals \u2013 The HIPAA Journal<\/a>
6. 23andMe Data Breach: What Was Exposed, Who Was Affected, and What Happens to Your DNA Now \u2013 <\/a>Security.org<\/a>
7. Reviewing the Salesforce\u2013Salesloft Drift OAuth Supply Chain Breach \u2013 Anomali<\/a>
8. Salesloft breached to steal OAuth tokens for Salesforce data-theft attacks \u2013 TechRadar<\/a>
9. Snowflake Data Breach \u2013 Huntress<\/a>
10. Data allegedly stolen from 560 million Ticketmaster users \u2013 BBC<\/a>
11. Have I Been Pwned: SoundCloud data breach impacts 29.8 million accounts \u2013 BleepingComputer<\/a><\/p>\n\n\n\n","protected":false},"excerpt":{"rendered":"