What is a data breach?

They’re the main reason why every large organization has a dedicated cybersecurity team on its payroll. But what exactly is a data breach, and how can you protect yourself from one as an individual?

Here, we’ll cover the basics of data breaches, their causes and consequences, and some tips to prevent them. Plus, we’ll explain how a password manager can help secure your personal and professional data with strong encryption and easy password management.

What is a data breach?

A data breach occurs when unauthorized parties gain access to confidential information or sensitive data.

This information can include personal data (Social Security numbers, bank account numbers, healthcare data, etc.) or corporate data (customer data records, intellectual property, financial information, trade secrets, etc.)

The term “data breach” is often used interchangeably with “cyberattack.” However, not all cyberattacks are data breaches — and not all data breaches are cyberattacks.

Data breaches happen when the confidentiality of data is compromised. So, for example, a cyberattack with the main goal of overwhelming a website, called a distributed denial of service (DDoS attack), isn’t a data breach.

On the other hand, a ransomware attack, meaning a criminal that steals a company’s customer data and threatens to sell it if the company doesn’t pay a ransom, is a data breach.

Data breaches don’t necessarily involve unauthorized data access through the internet or other digital channels. For example, the physical theft of hard drives, thumb drives, or even paper files containing sensitive information are all considered data breaches.

A history of data breaches

Data breaches aren’t a new concept. They have existed for as long as individuals and companies have kept records and stored private information.

Before computing became commonplace, a data breach was as simple as stumbling upon sensitive documents left on a desk (i.e., not properly stored or disposed of).

As technology advanced with more data stored and transmitted digitally, data breaches became more sophisticated and widespread.

Today, data breaches can impact hundreds of thousands of individual consumers — or even millions of individual records — all from a single attack on a company.

Here are the 10 largest data breaches in history, ranked by the number of impacted users or exposed records in a single attack, as of August 2023:

(Data source: Statista)

While these are the largest and most significant data breaches in history, they make up only a small fraction of the number of data breaches worldwide, and that number is growing.

In the last decade, reported annual data breaches in the US have more than quadrupled in number from 447 in 2012 to 1,802 in 2022.

The cost of a data breach

Data breaches can have a huge impact on the affected organization, particularly if it’s a large enterprise. Worldwide, each data breach in 2023 cost an average of $4.45 million across all industries, according to IBM.

The high cost comes from a combination of lost work, lost revenue, lost sales, ransom payments, and lawsuits. Data breaches significantly impacted the healthcare industry, with an average cost of $11 million in 2023, according to IBM’s Cost of a Data Breach Report. This finance industry took second place, with an average cost of $6 million.

Some data breaches have been particularly costly. For example, the Equifax data breach of 2017 exposed credit monitoring information, like the credit card numbers of over 140 million people, to cybercriminals.

According to the Federal Trade Commission, this breach cost the company $575 million in settlements.

Data protection legislation

Laws and regulations such as the Payment Card Industry Data Security Standard (PCI DSS) or the Health Insurance Portability and Accountability Act of 1996 (HIPAA) provide guidelines for companies and organizations handling sensitive consumer information in the healthcare and finance industries.

Sensitive personal data is subject to stricter legal protection thanks to a law known as the General Data Protection Regulation (GDPR). The European Union enforces this law to regulate the processing of personal data.

These regulations provide a robust framework for the required safeguards, storage, and best practices for handling sensitive information. However, as the most recent numbers show, these rules don’t exist in all industries, and they don’t definitively stop data breaches from happening.

Consequently, businesses and individuals must share the responsibility of keeping their data safe and secure. Doing so involves understanding the causes of data breaches, the type and source of targeted information, and how to protect that data from attacks.

What causes a data breach

Data breaches can happen for various reasons, ranging from human error to malicious attacks. Some of the most common causes of data breaches are:

• Stolen or compromised credentials. In this case, the criminal gains access to a user’s legitimate credentials (such as their login and password) and uses them to access a target system.
• Phishing scams. These are malicious emails or other types of messages designed using social engineering to manipulate or trick the reader into giving the sender sensitive information or downloading malware.
• Breach of third-party software. Third-party software tools may have security weaknesses or flaws that enable criminal actors to access information stored in the device where the software is installed.
• Malicious insider. In this case, someone within the target organization intentionally uses their credentials and security access to steal data (or helps others steal it).
• Accidental data loss. Data breaches may also be unintentional or caused by human error. For example, a user accidentally publishing sensitive data to the internet or on social media, or losing equipment such as a computer, a hard drive, or other storage device.

How data breaches target personal information

One of the main types of information that attackers target is personal data, which is any information that can identify or relate to a specific individual.

Criminals can use personal information obtained via data breaches for malicious purposes, such as identity theft, fraud, blackmail, or phishing.

The three typical types of personal information often targeted by data breaches are social media, email, and sensitive personal data.

Social media

Many users share their personal details, phone numbers, preferences, opinions, photos, videos, and contacts on social media. All of this information can reveal a lot about their identity, personality, lifestyle, and relationships.

Data breaches can exploit this information to create fake profiles, impersonate users, send spam messages, spread misinformation, or manipulate users’ behavior.

For example, in 2018, the Facebook-Cambridge Analytica scandal exposed how a political consulting firm harvested the personal data of millions of Facebook users.

Email

Email accounts are another common target of data breaches. Email accounts contain personal messages and other valuable information, like:

• Bank statements
• Subscriptions
• Notifications
• Passwords
• Receipts
• Invoices

Hackers can use this information to access other online accounts, steal money, make fraudulent purchases, or blackmail users.

For example, in 2014, a massive data breach exposed the email addresses and passwords of more than 500 million Yahoo users. After further investigation, Verizon (who acquired Yahoo in 2017) determined that the breach actually impacted all 3 billion Yahoo users, making it the second-largest data breach in history.

Sensitive personal data

Sensitive personal data is a special category of personal information that reveals more intimate and delicate aspects of an individual, like their:

• Religious or philosophical beliefs
• Trade union membership
• Racial or ethnic origin
• Sexual orientation
• Political opinions
• Biometric data
• Genetic data
• Health data

Data breaches that target sensitive personal data can cause serious harm to the individuals affected, such as discrimination, harassment, violence, or psychological distress.

For example, in 2016, a data leak exposed the personal data (including names, email addresses, and passwords) of over 412 million user accounts from The FriendFinder Network. The sensitive and adult nature of the services provided by the website and its affiliates made the consequences of this data leak particularly embarrassing and potentially ruinous for its victims.

Start protecting your data with a password manager

The reality is, data breaches occur – there’s always a chance that someone will find a vulnerability in your system or use social engineering to gain access to something valuable. It could even lead to identity theft. That’s why preparing for the possibility of a data breach with the help of a password manager is your safest bet.

1Password