A security breach occurs when someone gains unauthorised access to a system, account, network, device or protected information—or when security fails in a way that causes data or services to be exposed, altered, destroyed or lost.
A breach may be caused by a deliberate cyber attack, but not every breach involves a skilled attacker. An employee sending confidential information to the wrong person, a lost unencrypted laptop or a publicly accessible cloud folder can also create a security breach.
The effects range from a minor, quickly contained incident to extensive data compromise, fraud, ransomware and prolonged operational disruption. Understanding what is a security breach, how it happens and how to respond can help individuals and organisations limit the damage.
What Is a Security Breach?
A security breach is an incident in which established protections are bypassed, defeated or used incorrectly, resulting in unauthorised access or another harmful outcome.
It can affect:
- Online accounts
- Business networks
- Cloud platforms
- Computers and mobile devices
- Applications and websites
- Confidential documents
- Personal information
- Financial records
- Intellectual property
- Essential business services
The breach may expose information, but information theft is not always necessary. A criminal who changes supplier bank details has compromised the integrity of the data. Ransomware that makes systems unavailable has affected availability, even if no files are publicly released.
Security professionals commonly assess a breach according to three fundamental objectives:
Confidentiality means ensuring that information is only available to authorised people.
Integrity means protecting information and systems against unauthorised or accidental alteration.
Availability means ensuring that authorised users can access systems and information when required.
A security breach may affect one, two or all three objectives.
For example, an attacker might steal customer records, alter the organisation’s payment details and encrypt its servers. That single incident affects confidentiality, integrity and availability.
Security Breach, Cyber Attack and Data Breach: What Is the Difference?
These terms overlap, but they do not mean exactly the same thing.
Security breach
A security breach is the successful breakdown or violation of a security control. Someone may gain unauthorised access, or information may be exposed, altered, lost or destroyed.
The term can cover both deliberate and accidental incidents.
Cyber attack
A cyber attack is a deliberate attempt to compromise a system, account, network or service.
The attempt does not have to succeed. A phishing message, password-guessing attempt or malicious network scan can be considered part of an attack even if the organisation blocks it.
A security breach occurs when the attacker successfully overcomes a control or causes a harmful security outcome.
Data breach
A data breach involves information being accessed, disclosed, altered, lost or destroyed without proper authority.
A data breach may result from a cyber attack, but it can also happen accidentally. Sending a spreadsheet to the wrong recipient can be a data breach without involving hacking.
Personal data breach
Under UK data-protection rules, a personal data breach is a security failure that causes the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
Personal data is information relating to an identifiable person. It may include names, addresses, identification numbers, account information, health details or employment records.
Security incident
A security incident is a broader term for an event that may threaten information or systems. An incident might be a confirmed breach, an attempted attack or suspicious activity requiring investigation.
For example, an unexpected administrator login is a security incident. Further investigation may show that it was legitimate, an unsuccessful attack or evidence of an actual breach.
What Is Data Compromise?
Data compromise occurs when information can no longer be trusted to remain confidential, accurate or available.
It may involve:
- Unauthorised viewing
- Copying or downloading
- Accidental disclosure
- Malicious publication
- Unauthorised alteration
- Deletion
- Encryption by ransomware
- Loss of access
- Loss of a device containing the data
An organisation does not need proof that criminals have already misused the information before treating it as compromised.
Suppose an unencrypted laptop containing customer records is stolen. The organisation may not know whether the thief opened the files, but it can no longer guarantee their confidentiality. The information should therefore be treated as potentially compromised.
The sensitivity of the data also matters. Exposure of a public company brochure is very different from exposure of passwords, medical records or safeguarding information.
How Does a Security Breach Happen?
Most breaches develop through a series of events rather than a single dramatic action.
A typical sequence might look like this:
- An attacker identifies a person, account or technical weakness.
- They send a convincing message or exploit an exposed system.
- They obtain access to one account or device.
- They collect additional information or permissions.
- They move towards more valuable systems.
- They steal, alter or encrypt data.
- They attempt to hide their activity or maintain access.
Not every incident follows this pattern. A cloud misconfiguration can expose information immediately, while an accidental email may create a breach in seconds.
Attackers also differ in their aims. Some seek money, while others may want confidential information, operational disruption, political advantage or access to a larger organisation through its supplier.
Common Causes of Security Breaches
Security breaches usually involve a combination of human, technical and organisational weaknesses. Treating every breach as the fault of one employee can hide the deeper reasons it was able to happen.
1. Phishing and Social Engineering
Phishing is one of the most common starting points for a security breach in cyber security.
An attacker sends an email, text message or other communication designed to persuade someone to:
- Enter a password on a false login page
- Open a malicious attachment
- Install unsafe software
- Reveal confidential information
- Approve an unexpected authentication request
- Transfer money
- Change payment details
The message may imitate a manager, bank, supplier, delivery company or technology provider.
Targeted messages can be especially convincing because the attacker may use real names, job titles, projects or previous conversations. This is often called spear phishing.
Phishing succeeds partly because it exploits normal human behaviour. Employees are expected to respond to colleagues, process invoices and act on urgent requests. Effective defence must therefore combine training with technical controls such as email filtering, stronger authentication and independent verification of sensitive requests.
2. Weak, Stolen or Reused Passwords
Passwords may be exposed through phishing, malware, previous data breaches or insecure storage.
Password reuse makes the problem more serious. If someone uses the same password for several accounts, criminals may try credentials stolen from one service against others.
Attackers may also target:
- Default passwords
- Shared accounts
- Old employee accounts
- Accounts without multi-factor authentication
- Poorly protected administrator accounts
- Passwords stored in readable documents
An account takeover may provide access to email, cloud files, customer information and password-reset links for other services.
Unique passwords, passkeys and multi-factor authentication can significantly reduce this risk.
3. Unpatched Software
Software vulnerabilities are weaknesses that attackers may use to gain access, run code or interfere with a system.
Manufacturers frequently release security updates to correct known weaknesses. A system remains exposed when an organisation delays updates without suitable alternative protection.
Internet-facing systems deserve particular attention because they can be reached remotely. These may include websites, email servers, remote-access services, firewalls and cloud applications.
Older devices and applications may no longer receive updates. Continuing to use unsupported technology can create a long-term weakness that becomes increasingly difficult to manage.
4. Incorrect Security Configuration
A system can be technically secure but exposed because it has been configured incorrectly.
Common examples include:
- A cloud folder shared publicly
- A database exposed to the internet
- Excessive user permissions
- An administrator interface left accessible
- A firewall rule allowing unnecessary traffic
- Security logging being disabled
- Default credentials remaining active
- Sensitive files being stored without encryption
Misconfiguration can arise from human error, unclear responsibility, rushed deployment or complicated technology.
Secure default settings, peer review, automated checks and regular permission reviews can reduce these problems.
5. Malware and Ransomware
Malware is software created or used for harmful purposes. It may steal information, monitor activity, provide remote access or damage systems.
Ransomware is malware that prevents access to devices or files, commonly by encrypting them. Criminals then demand payment and may threaten to publish stolen information.
Modern ransomware incidents can therefore involve two forms of harm:
- Systems and files become unavailable.
- Sensitive information may be stolen before encryption.
Malware may enter through phishing, unsafe downloads, compromised websites, exposed services or vulnerable software.
Endpoint protection, software updates, restricted privileges, network segmentation and protected backups can reduce the likelihood and impact of infection.
6. Insider Actions
An insider is someone with legitimate access to an organisation’s systems or information. This may include employees, contractors, volunteers or suppliers.
Insider breaches can be deliberate or accidental.
A malicious insider might copy customer records, share confidential plans or abuse administrative access. An accidental insider incident might involve sending information to the wrong recipient, losing a device or changing a setting incorrectly.
The solution is not to treat every employee as untrustworthy. Organisations should apply least privilege, monitor sensitive access and remove permissions when they are no longer required.
They should also create a culture in which mistakes are reported promptly rather than hidden through fear.
7. Third-Party and Supply-Chain Weaknesses
Organisations depend on software providers, contractors, payment processors, cloud services and other suppliers.
A supplier may hold sensitive information or connect directly to internal systems. If that supplier is compromised, attackers may use the relationship to reach customers or distribute malicious software.
Supply-chain risk can be difficult to manage because organisations do not directly control every supplier’s technology.
Risk can be reduced through:
- Security checks before contracting
- Clear contractual responsibilities
- Limited supplier access
- Multi-factor authentication
- Monitoring third-party accounts
- Prompt removal of access
- Incident-notification requirements
- Alternative plans for critical services
Smaller suppliers should not be assumed to present a lower risk. Attackers may target them precisely because their security controls are weaker.
8. Lost or Stolen Devices
Laptops, phones, storage drives and printed records can all contain sensitive information.
A device loss becomes more serious when:
- Storage is not encrypted
- The screen is unlocked
- Accounts remain signed in
- Remote wiping is unavailable
- Sensitive files are stored locally
- The loss is reported slowly
Full-disk encryption, automatic screen locks and remote-management controls can limit the consequences.
Organisations should also be able to revoke active sessions and assess what information was accessible from the device.
9. Human Error
Not every error is caused by carelessness. People often work under pressure, use complicated systems and follow unclear procedures.
Common errors include:
- Sending information to the wrong person
- Uploading a file to the wrong folder
- Granting excessive access
- Publishing confidential documents
- Misconfiguring a service
- Failing to remove an old account
- Disposing of records insecurely
Good security design reduces the opportunity for one mistake to cause major harm. Clear approval processes, secure defaults, access controls and confirmation prompts can all help.
10. Physical Security Failures
Cyber security also depends on physical protection.
Someone who gains direct access to equipment may steal a device, connect unauthorised hardware, remove a storage drive or change system settings.
Server rooms, network equipment and backup media should therefore be protected against unauthorised access.
Visitors and contractors may need supervised access, while old equipment should be securely erased or destroyed before disposal.
Warning Signs of a Possible Security Breach
A breach may be discovered through an automated alert, employee report, customer complaint or notification from an external organisation.
Possible signs include:
- Unexpected password-reset messages
- Login alerts from unfamiliar devices or locations
- New administrator accounts
- Unexplained changes to files or settings
- Disabled security tools
- Unusual outgoing network traffic
- Large or unexpected downloads
- Messages sent from an account without the owner’s knowledge
- New email-forwarding or inbox rules
- Locked or encrypted files
- Unavailable systems
- Customers receiving suspicious messages
- Payment details changing unexpectedly
- Confidential information appearing online
One warning sign does not always prove that a breach has happened. Legitimate travel, maintenance or software updates may create unusual activity.
However, suspicious events should be investigated rather than dismissed without evidence.
Security Breach Examples
The following breach examples show how different incidents can affect confidentiality, integrity and availability.
Example 1: Stolen email password
An employee enters their email credentials into a false login page. The attacker signs in, reads messages and creates a forwarding rule.
This is an account and information breach. The attacker may also use the mailbox to request fraudulent payments or reset other passwords.
Example 2: Public cloud folder
A team accidentally changes a cloud-storage folder so anyone with the link can view it. The folder contains customer records.
No one has hacked the cloud provider, but confidential information has been exposed through incorrect permissions.
Example 3: Ransomware attack
Malware enters through an unpatched remote-access service. It spreads across the network, steals files and encrypts servers.
The incident affects confidentiality and availability. Business operations may remain disrupted while the organisation investigates and restores systems.
Example 4: Email sent to the wrong person
An employee sends a spreadsheet containing staff information to an unintended recipient with a similar name.
This is an accidental data breach. The organisation should try to recover or securely delete the information and assess the risk to affected employees.
Example 5: Lost laptop
A laptop containing unencrypted client files is left on public transport.
Even without proof that the files were opened, the organisation can no longer be confident that the information remains private.
Example 6: Changed supplier details
A criminal compromises a supplier’s email account and sends new bank details to a customer. The customer pays a genuine invoice into the attacker’s account.
This breach affects the integrity of business communications and can lead directly to financial fraud.
Example 7: Former employee account
An employee leaves, but their cloud account remains active. The password is later exposed, allowing someone to enter the organisation’s files.
Prompt account closure and regular access reviews could have prevented the breach.
Example 8: Compromised software supplier
A trusted software update is altered before reaching customers. Organisations install it because it appears to come from a legitimate supplier.
This supply-chain breach may affect many organisations through a single trusted relationship.
Consequences of a Security Breach
The impact of a breach depends on the affected systems, the information involved and how quickly the incident is contained.
Consequences for individuals
People affected by data compromise may experience:
- Identity fraud
- Financial theft
- Account takeover
- Targeted phishing
- Exposure of private information
- Discrimination
- Safeguarding risks
- Emotional distress
- Damage to professional reputation
Criminals may combine exposed information with data from other sources to create convincing scams.
Consequences for organisations
An organisation may face:
- Operational downtime
- Lost sales or productivity
- Recovery and investigation costs
- Contractual disputes
- Regulatory scrutiny
- Legal claims
- Customer complaints
- Reputational damage
- Loss of intellectual property
- Higher insurance or security costs
The indirect effects may last longer than the technical incident. Systems might be restored quickly, but customers and partners may take longer to regain confidence.
How to Respond to a Security Breach
Incident response should be planned before a breach occurs. Decisions are harder to make when systems are failing, information is incomplete and pressure is increasing.
1. Confirm and Triage the Incident
Begin by gathering reliable facts.
Determine:
- What was detected
- When it was discovered
- Which systems or accounts are involved
- Whether the activity is continuing
- Who reported it
- What information may be affected
- Whether essential services are at risk
Avoid announcing conclusions before the evidence supports them. At the same time, do not delay urgent protective action while waiting for perfect information.
Assign a severity level so the incident receives appropriate resources and leadership attention.
2. Contain the Breach
Containment aims to stop further damage.
Actions may include:
- Disabling a compromised account
- Revoking active sessions
- Isolating an infected device
- Blocking malicious connections
- Removing public access to a folder
- Disabling an exposed service
- Changing affected credentials
- Restricting supplier access
Containment should be coordinated. Switching off critical systems without understanding the consequences may interrupt services or destroy useful evidence.
3. Preserve Evidence
Keep records of what happened and what actions were taken.
Useful evidence may include:
- System and network logs
- Security alerts
- Email records
- Account activity
- File-access records
- Device information
- Screenshots
- Timelines
- Copies of suspicious messages
Do not alter or delete evidence unnecessarily. Serious incidents may require specialist forensic investigation or support legal, insurance and regulatory processes.
4. Assess the Scope and Impact
The organisation needs to understand how far the breach extends.
Questions include:
- How did the attacker gain access?
- How long was access available?
- Which accounts and devices were affected?
- Did the attacker move to other systems?
- Was information viewed, copied, altered or deleted?
- Which people or organisations may be affected?
- What business services have been interrupted?
- Does the problem involve a supplier?
This assessment may change as new evidence appears. Incident teams should clearly separate confirmed facts from assumptions.
5. Remove the Cause
Eradication means correcting the weakness and removing unauthorised access.
This may involve:
- Removing malware
- Closing vulnerable services
- Applying security updates
- Correcting cloud permissions
- Rebuilding compromised devices
- Resetting credentials
- Removing unauthorised accounts
- Replacing exposed authentication keys
- Strengthening detection rules
Simply restoring files without closing the original entry point may allow the attacker to return.
6. Recover Safely
Recovery returns systems and services to normal operation.
The organisation should:
- Restore from trusted backups
- Verify that systems are clean
- Apply necessary updates
- Monitor accounts and devices
- Reconnect systems in a controlled order
- Confirm that important services work
- Continue looking for signs of persistence
Recovery priorities should reflect business needs. Essential services may need to return first, while less critical systems remain offline for investigation.
7. Report and Communicate
A breach may need to be reported to regulators, law enforcement, insurers, customers, employees, suppliers or contractual partners.
Communication should be accurate, clear and coordinated. Avoid unsupported reassurance, speculation or technical detail that could create further risk.
People affected by the breach should receive useful information, including:
- What happened
- What information was involved
- What the organisation has done
- What risks may remain
- What protective steps they can take
- How they can obtain support
8. Learn from the Incident
After recovery, conduct a structured review.
Consider:
- Which controls failed
- Which controls worked
- Whether the breach was detected quickly
- Whether responsibilities were clear
- Whether communication was effective
- Whether backups and recovery processes worked
- What changes should receive priority
- Whether similar weaknesses exist elsewhere
The purpose is improvement rather than finding one convenient person to blame. A mistake may reveal a wider problem with training, workload, system design or management.
When Must a Personal Data Breach Be Reported in the UK?
Not every security breach involves personal data, and not every personal data breach must be reported to the Information Commissioner’s Office.
An organisation should assess the likely risk to the rights and freedoms of the people affected.
Where the breach meets the reporting threshold, it must be reported to the ICO without undue delay and, where feasible, within 72 hours of discovery.
The clock begins when the organisation becomes aware of the breach, not necessarily when the incident first happened.
If all the details are not yet available, an initial report can be made and followed with further information.
Where a personal data breach is likely to create a high risk for affected people, the organisation must normally tell them without undue delay. The communication should explain the incident in clear language and provide practical protective advice.
Organisations should record the breach and their decisions even when they conclude that ICO notification is unnecessary. This creates an evidence trail showing how the risk was assessed.
How to Prevent Security Breaches
No organisation can remove every cyber threat, but common controls can prevent many incidents or reduce their impact.
Protect accounts
Use unique passwords, passkeys or a managed password system. Enable multi-factor authentication for email, cloud services and administrator accounts.
Remove unused accounts promptly and review privileged access regularly.
Keep systems updated
Maintain an inventory of software, devices and cloud services. Apply important security updates promptly, particularly to internet-facing systems.
Replace unsupported technology or isolate it while a replacement is arranged.
Limit access
Follow least privilege. Users should receive only the access needed for their responsibilities.
Sensitive administrative accounts should not be used for ordinary email or web browsing.
Secure cloud services
Review storage permissions, connected applications and administrator accounts. Enable logging and alerts for important changes.
Do not assume the cloud provider manages every customer security setting.
Use layered malware protection
Combine email filtering, endpoint protection, application controls, updates and restricted privileges.
Network segmentation can also reduce the spread of malware between systems.
Maintain protected backups
Keep reliable backups separated from normal systems so an attacker cannot easily encrypt or delete them.
Test restoration procedures. A backup is not useful unless the organisation can recover the required information within an acceptable period.
Train employees
Training should address realistic situations such as phishing, payment changes, account security and incident reporting.
Employees should know exactly where to report a suspicious message or mistake. Fast reporting can turn a potential major breach into a manageable incident.
Review suppliers
Understand which suppliers hold information or access systems. Limit their permissions and include clear security and incident-notification responsibilities in contracts.
Monitor important activity
Collect useful logs from accounts, endpoints, networks and cloud services.
Create alerts for suspicious behaviour and make sure someone is responsible for investigating them.
Practise incident response
Test the response plan through realistic exercises. Include technical staff, managers, communications teams and other relevant decision-makers.
A plan that has never been rehearsed may fail when it is needed most.
What Should Individuals Do After Their Data Is Breached?
People notified of a breach should follow the specific advice given by the affected organisation.
Useful general steps may include:
- Change an exposed or reused password.
- Enable multi-factor authentication.
- Check account activity and signed-in devices.
- Monitor bank and payment accounts.
- Be alert to targeted phishing messages.
- Verify unexpected calls or emails independently.
- Avoid sharing security codes.
- Contact the relevant provider about suspicious activity.
- Keep copies of breach notifications and related records.
Criminals may use genuine breach information to make later scams appear convincing. A message mentioning the correct organisation or personal detail should not automatically be trusted.
Frequently Asked Questions
Is a security breach always a cyber attack?
No. A breach may result from a deliberate attack, but it can also be caused by accidental disclosure, lost equipment, poor permissions or another security failure.
Is every cyber attack a security breach?
No. An attack may be blocked before it gains access or causes harm. A breach means that a security control was successfully bypassed or a protected asset was compromised.
What is the most common cause of a security breach?
Phishing and stolen credentials are among the most common starting points. However, unpatched software, poor configuration, insider actions and supplier weaknesses also cause breaches.
Can a small business experience a security breach?
Yes. Small businesses use email, payment systems, cloud storage and customer data, making them potential targets. Limited monitoring may also allow incidents to remain unnoticed.
Does a data breach mean information was published online?
No. Data can be compromised through unauthorised access, accidental disclosure, alteration, loss or destruction without being published publicly.
How quickly should a breach be contained?
Containment should begin as soon as the organisation has enough information to take safe, proportionate action. Legal and contractual reporting deadlines should also be considered immediately.
Must every personal data breach be reported to the ICO?
No. Reporting depends on the likely risk to people’s rights and freedoms. Organisations should document their assessment even when notification is not required.
Can antivirus software prevent every breach?
No. Antivirus can help detect malware, but it cannot prevent every phishing attack, stolen password, cloud misconfiguration or accidental disclosure.
What is the first step in incident response?
The first step is to confirm and assess the incident while beginning any urgent containment needed to prevent further harm. The organisation should also start documenting events immediately.
Conclusion
A security breach is any successful failure of protection that results in unauthorised access, disclosure, alteration, loss, destruction or disruption. It may arise from a cyber attack, but human error, insecure configuration, lost devices and supplier weaknesses can produce similar consequences.
The effects can include data compromise, fraud, operational downtime and loss of trust. A quick but organised response is therefore essential. Organisations should confirm the facts, contain the breach, preserve evidence, assess the impact, remove the cause and recover from trusted systems.
Prevention depends on layers of protection rather than one product. Strong authentication, security updates, least privilege, secure cloud settings, monitoring, backups and employee awareness all help reduce risk.
Breaches cannot always be prevented, but preparation makes a major difference. An organisation that knows its systems, practises incident response and encourages rapid reporting is better placed to limit damage and protect the people who depend on it.