Got a worrying notice and wondering what is a data breach? It’s a security incident in which unauthorized people access sensitive or confidential data, even if nothing leaves the network. Here’s what happens and how to respond.
This explainer is part of the technology news section of this independent site.
| Item | Value |
|---|---|
| Global average cost of a breach (2025) | $4.44 million |
| U.S. average cost per incident | $10.22 million |
| Healthcare average breach cost | $7.42 million |
| Average time to detect and contain a breach (2025) | 241 days |
| Share of breaches involving ransomware (2025) | 44% |
| Share of breaches caused by phishing | 16% |
These figures come from CyberDefenders’ data breach guide, last updated Sep 15, 2026. Figures like these can change, so check the source before you rely on them.
What a data breach actually covers
A data breach is a security incident in which sensitive, protected or confidential information is accessed, disclosed or exposed to unauthorized parties, according to CyberDefenders. That includes employee records, customer data, financial details, intellectual property, health records and login credentials.
The data does not have to leave the network to count. If an unauthorized user reads, copies or even views restricted data, a breach has occurred.
Outside attackers are only one cause. Breaches can also come from malicious insiders, misconfigured systems, lost devices or an employee clicking the wrong link.
Breach, leak and cyberattack compared
People often use these three terms as if they meant the same thing, but they describe different events.
- Data breach: unauthorized access to sensitive data through active exploitation or insider action, such as an attacker taking a customer database.
- Data leak: sensitive data exposed without an attack, through misconfiguration or accidental sharing, such as a storage bucket left publicly accessible.
- Cyberattack: a broad offensive action against systems, such as malware, DDoS or ransomware.
Not every cyberattack exposes data, and a leak may involve no attacker at all, just a poor configuration. Headlines often blur these terms, so it helps to know how to read tech news critically before you act on a breach story.
How data breaches happen
Most breaches follow a recognizable pattern. Someone finds a weak point, uses it to gain access, and then either steals data or settles in for a longer campaign.
Phishing is the most common attack vector, accounting for 16% of all breaches, according to CyberDefenders. It uses fraudulent emails, text messages or fake websites to trick people into revealing credentials or downloading malware.
Stolen or compromised credentials account for 10% of initial attack vectors, and those breaches can take up to 186 days to identify, as the guide reports. It also notes that more than 2.8 billion passwords were posted on criminal forums in 2024.
Ransomware was present in 44% of all data breaches in 2025, up from 32% in 2024, per CyberDefenders. Modern attacks typically combine encryption with data theft, so organizations face disruption and breach notification duties at the same time.
Insiders were involved in 30% of breaches, and third-party involvement doubled to 30% of all breaches in 2025, according to the guide. Insiders include malicious staff, people with excessive access and well-meaning employees who send files to the wrong recipient.
Finally, cloud misconfiguration played a part too: CyberDefenders links 21 major breaches in 2024 to misconfigured cloud security settings.
What gets exposed and how breaches are spotted
Attackers go after whatever is most valuable or most accessible, and sometimes both. Commonly exposed categories include:
- Personal information such as names, addresses, dates of birth and Social Security numbers.
- Authentication data such as passwords, session tokens, API keys and certificates.
- Financial data such as card numbers, bank account details and transaction records.
- Health records, including diagnoses, treatment history and insurance information.
- Intellectual property and corporate data, from source code to contracts and strategic plans.
According to Verizon’s 2025 data, as cited by CyberDefenders, email addresses were compromised in 61% of breaches, followed by phone numbers (39%), passwords (28%) and IP addresses (13%).
Breaches are often silent early on, because attackers move slowly to avoid detection. On average it took organizations 194 days to identify a breach in 2024, the guide says.
Technical warning signs include:
- Unusual login activity.
- Off-hours access.
- Logins from unexpected geographies.
What a breach costs
The global average cost of a data breach reached $4.44 million in 2025, according to IBM as cited by CyberDefenders. U.S. organizations faced an average of $10.22 million per incident, the highest of any country.
Healthcare is the costliest sector, at an average of $7.42 million per breach, making it the most expensive industry for the 14th consecutive year, the guide notes.
Speed matters as well. Organizations that took longer than 200 days to identify and contain a breach faced an average cost of $5.01 million, nearly $1.4 million more than those that contained it faster, per CyberDefenders.
Beyond direct costs, breaches bring:
- Regulatory fines.
- Legal liability, including class-action lawsuits and investigations.
- Reputational damage, from customer churn to lost partner trust.
- Operational disruption, from downtime to lost productivity.
As of the source’s Sep 15, 2026 update, GDPR penalties can reach €20 million or 4% of global revenue, CyberDefenders reports.
What to do if your data is in a breach?
This is general information, not legal or security advice. A sensible order of action looks like this:
- Read the notice to see which types of data were exposed, since passwords carry different risks than an email address.
- If login details were involved, change that password and turn on multi-factor authentication (MFA), which the guide lists as a key control against stolen credentials.
- Treat unexpected emails, texts and links with suspicion, because phishing is a common way attackers get in.
- Confirm what happened through the organization’s official channels rather than through links in unsolicited messages.
Organizations have a longer list. CyberDefenders pairs each attack vector with a prevention control:
- Phishing: security awareness training and email filtering.
- Stolen credentials: MFA, passwordless authentication and privileged access management.
- Ransomware: endpoint detection, network segmentation and offline backups.
- Insider threats: zero trust, least-privilege access and data loss prevention.
- Third parties: vendor risk assessments and supply chain monitoring.
If you want another topic explained in plain language, read about what is quantum computing.
Frequently asked questions
Is a data leak the same as a data breach?
Show answer
No. A data leak is sensitive data exposed without an attack, such as through misconfiguration or accidental sharing, while a breach implies unauthorized access. A leak may involve no attacker at all, as CyberDefenders explains.
Does data have to leave a network to be a breach?
Show answer
No. Theft isn’t required: CyberDefenders treats an unauthorized person merely looking at protected records as a breach.
What is the most common way breaches start?
Show answer
Tricking a person usually comes first. Phishing leads the list at 16% of all breaches, ahead of stolen credentials at 10% of initial attack vectors, as the guide tallies it.
How long does it take to find a breach?
Show answer
On average, organizations took 194 days to identify a breach in 2024, and breaches that began with compromised credentials can take up to 186 days to identify, according to CyberDefenders.
