A data breach or leak is an incident in which unauthorized persons gain access to a data collection. If the term is interpreted broadly, it also includes the unwanted deletion of data (data loss). Data breaches are breaches of data security and data protection in which state secrets, trade secrets or personal data have presumably or demonstrably become known to unauthorized persons. It does not matter whether the data is in analogue or electronic form. These include:
- Conscious or unconscious unauthorised processing of data (e.g. data leakage),
- Unauthorized activities to circumvent data processing safeguards;
- Attacks on a company’s IT infrastructure.
The data may be lost in the original form (e.g. by losing, stealing or incorrectly disposing of data carriers or files) or in the form of a copy (e.g. by penetrating a server, disseminating accidentally published data or the work of informants). In some cases, the data not only comes into the possession of individual unauthorized persons, but are also published by them.
In some countries, there is an obligation to provide information in the event of a data breach involving personal data. In these cases, the data subjects, the supervisory authorities or the public must be notified. On the other hand, companies usually refrain from publishing them if trade secrets are involved in order to avert damage to their image.
---
Preventing Data Breaches
Data breaches can either be detected within an organization or brought to its attention from the outside. This is done from within, for example, through employee interviews, audits of processes in which sensitive data is processed, evaluation of server logs, observation of irregularities or warning mechanisms in the event of unauthorized access. External information may be provided by third parties, by media reports or by filing a complaint with the competent supervisory authority. To ensure that reports from third parties are processed quickly and reliably, there should be a defined reporting channel. To reduce the risk of data breaches, it’s a good idea to choose complex passwords, install security updates regularly, and enable two-factor authentication, if available.
Data breaches usually have negative consequences. For the perpetrators and, in the case of personal data, also for the data subjects, this can be economic disadvantages or damage to their image. In a few cases, data breaches can also have positive consequences, for example if, similar to whistleblowing, they reveal important information that has been withheld from the public.
If personal data is affected by a data breach, there is a risk of identity theft. The data may be enriched by criminals through phishing. Those affected can then suffer great financial and personal damage.
