A data breach is an incident where information is stolen or taken from a system without the knowledge or authorisation of the system’s owner.
Table of Contents
If you have had information stolen from a system without your knowledge or authorisation, you have experienced a data breach. When it comes to data breaches, they are not discriminatory—affecting companies and systems of all sizes. Stolen data may involve sensitive, proprietary, or confidential information such as credit card numbers, customer data, trade secrets, or matters of national security.
The effects brought on by a data breach can come in the form of damage to the target company’s reputation due to a perceived “betrayal of trust”. Victims and their customers may also suffer financial losses, should related records be part of the information stolen.
How data breaches happen
Most data breaches are attributed to hacking or malware attacks. The most common types of data breaches include the following:
- Insider leak: A trusted individual or person of authority with access privileges steals data.
- Payment card fraud: Payment card data is stolen using physical skimming devices.
- Loss or theft: Portable drives, laptops, office computers, files, and other physical properties are lost or stolen.
- Unintended disclosure: Through mistakes or negligence, sensitive data is exposed.
- Unknown: In a small of number of cases, the actual breach method is unknown or undisclosed
Phases of a data breach
Research
The attacker, having picked a target, looks for weaknesses to exploit employees, systems, or the network. This entails long hours of research on the attacker’s part and may involve stalking employees’ social media profiles to find out what sort of infrastructure the company has.
Attack
Having scoped a target’s weaknesses, the attacker makes initial contact either through a network-based or social attack.
In a network-based attack, the attacker exploits weaknesses in the target’s infrastructure to instigate a breach. These weaknesses may include, but are not limited to SQL injection, vulnerability exploitation, and/or session hijacking.
In a social attack, the attacker uses social engineering tactics to infiltrate the target network. This may involve a maliciously crafted email sent to an employee, tailor-made to catch that specific employee’s attention. The email can phish for information, fooling the reader into supplying personal data to the sender, or come with a malware attachment set to execute when downloaded.
Exfiltrate
Once inside the network, the attacker is free to extract data from the company’s network. This data may be used for either blackmail or cyberpropaganda. The information an attacker collects can also be used to execute more damaging attacks on the target’s infrastructure.
Data breach consequences
A data breach can have serious consequences for businesses of any size, going beyond immediate financial loss. After a breach, companies often face legal scrutiny, reputational damage, and long-term operational disruptions. The aftermath typically involves costly incident response, customer remediation, and tighter regulatory oversight.
Common consequences of a data breach include:
- Financial loss: Costs related to incident response, legal action, fines, and customer compensation can quickly escalate.
- Reputational damage: Loss of customer trust and negative media coverage can harm brand credibility and market share.
- Regulatory penalties: Violations of laws like GDPR or HIPAA can result in significant fines and sanctions.
- Legal liability: Businesses may face lawsuits from customers, employees, or partners affected by the breach.
- Operational disruption: Critical systems may be taken offline, halting productivity and service delivery.
- Increased cybersecurity scrutiny: Breached organisations often face greater oversight from regulators, investors, and customers.
- Loss of intellectual property: Trade secrets or proprietary data stolen during a breach can affect long-term competitiveness.
Preventing a data breach
For enterprises
- Patch systems and networks accordingly: IT administrators should make sure all systems in the network are patched, updated, and conduct regular cybersecurity audits to prevent attackers from exploiting vulnerabilities in unpatched or outdated software.
- Educate and enforce: Inform your employees about the threats, train them to watch out for social engineering tactics, and introduce and/or enforce guidelines on how to handle a threat if encountered.
- Implement security measures: Create a process to identify vulnerabilities and address threats in your network. Regularly perform security audits, implement network intrusion prevention measures, and ensure that all systems connected to your company network are properly accounted for.
- Create contingencies: Put an effective disaster recovery plan in place. In the event of a data breach, minimise confusion by being ready with contact persons, disclosure strategies, actual mitigation steps, and the like. Make sure that your employees are made aware of this plan for proper mobilisation once a breach is discovered.
For employees
- Keep track of your banking receipts: The first sign of being compromised is finding strange charges on your account that you did not make.
- Don’t believe everything you see: Social engineering preys on the gullible. Be skeptical and vigilant.
- Be mindful of what you share on social media: Don’t get carried away. If possible, don’t reveal too much about yourself on your profile.
- Secure all your devices: These devices include laptops, mobile devices, and wearables. Ensure that they are protected by security software that is always updated.
- Secure your accounts: Use a different email address and password for each of your accounts. You may opt to use a password manager to automate the process.
- Do not open emails from unfamiliar senders: When in doubt, delete suspicious-looking emails without opening it. Always try to verify who the sender is and the contents of the email before opening any attachment.
Examples of recent data breaches
AT&T data breach
In July 2024 AT&T, data including phone numbers, call and text message records, interaction details, and call durations were compromised.
In total, around 110 million AT&T customers were notified about the breach. The affected data also extends to customers of other cell carriers using AT&T’s network.
On July 29th, AT&T paid a hacker approximately $370,000 to delete some of the customer data.
In October 2024 AT&T agreed to pay $13 million to settle an investigation regarding a data breach of a cloud vendor in January 2023, which affected 8.9 million AT&T wireless customers, according to the Federal Communications Commission (FCC).
If you want to learn more, find all the details on the AT&T data breach.
Ticketmaster data breach
In May 2024, Ticketmaster was victim of a huge data breach that affected 560 million users. The hacker group, ShinyHunters, claimed to have breached Ticketmaster systems and stolen a giant haul (1.3 terabytes) of customer data, including names and addresses, phone numbers, order history, and partial payment details.
In July 2024, samples of the data appeared on dark web forums.
If you want to learn more, find all the details on the Ticketmaster data breach.
23andMe data breach
In October 2023, the popular DNA and ancestry testing company, 23andMe, suffered a major data breach due to a credential stuffing attack. This type of cyberattack occurs when hackers use stolen usernames and passwords from other breaches to break into accounts. Credential stuffing takes advantage of people reusing the same passwords on different sites, making it a common and dangerous threat. Unfortunately, this incident exposed the records of 4 million customers, sparking serious concerns about the safety of sensitive genetic information.
If you want to learn more, find all the details on the 23andMe data breach.
Data breach vs. data leak
While the terms “data breach” and “data leak” are often used interchangeably, they carry different implications. A data breach occurs when an unauthorised individual gains access to view or acquires confidential, sensitive, or protected information without the user’s consent. On the other hand, a data leak is an unintentional exposure of data due to misconfiguration or human error.
Data breach prevention tips
Determining if you’ve been affected by a data breach early is crucial for minimising its impact. Here are several signs that may indicate your information has been compromised:
- Notification from an organisation: Organisations experiencing a data breach are legally obligated to notify affected individuals. Pay attention to any breach notifications and follow the recommended steps.
- Unusual account activity: Monitor your financial accounts for any suspicious and unauthorised transactions or activity, including new accounts opened in your name or changes to your account information.
- Phishing emails: Be skeptical of unsolicited messages or emails requesting personal information or payment.
What to do if you’re a victim of a data breach
If you suspect that your data has been compromised in a data breach, follow these steps:
- Change your passwords: Update your passwords for all affected online accounts immediately and use strong, unique passwords. Consider using a password manager to store your passwords securely.
- Enable two-factor authentication: Add an extra layer of security to your accounts by activating two-factor authentication.
- Contact affected organisations: Inform your bank or credit card issuer immediately if the breach affects financial accounts so they can assist you in securing your accounts.
- Monitor your accounts: Review your credit reports and financial statements frequently for any signs of fraud.
- Consider credit monitoring services: These services can help you watch for any unusual changes in your credit history, or any fraudulent activity related to your personal information.
- Stay informed: Follow news related to the breach to stay informed about any further developments and potential risks.
Remember, staying vigilant and taking proactive measures can help mitigate the impact of a data breach.
Where can I get help securing against a data breach?
Stopping adversaries faster and taking control of your cyber risks starts with a single platform. Manage security holistically with comprehensive prevention, detection, and response capabilities powered by AI and leading threat research and intelligence.
Trend Vision One™ supports diverse hybrid IT environments, automates and orchestrates workflows, and delivers expert cybersecurity services, so you can simplify and converge your security operations.