Data breach
noun · also Breach · NIST CSRC Glossary
A confirmed incident in which protected data, such as personal or confidential information, was accessed, disclosed or stolen without authorization.
Not every security incident is a breach. A blocked phishing email, a malware infection with no data access, or a denial-of-service attack are incidents; a breach means protected data was actually exposed to someone who should not have it. That distinction matters because breaches can trigger legal obligations: notifying regulators, affected individuals, customers or partners.
The rules depend on where the organization and the affected people are. The EU's GDPR, for example, requires notifying the supervisory authority within 72 hours of becoming aware of a personal data breach in most cases, and Brazil's LGPD requires communicating relevant incidents to the national authority (ANPD) and to the data subjects within the deadlines it sets. Contracts and sector rules often add their own requirements.
Example
A misconfigured cloud storage bucket containing customer records is found to be publicly accessible, and access logs show it was downloaded by an unknown IP address. Even without any malware or intrusion, the exposure of the records is a data breach that legal and privacy teams must assess for notification.
Why it matters for a SOC analyst
Analysts are rarely the ones who declare a breach, but they produce the evidence that decision depends on: what data was accessed, by whom, when, and how much. Precise, timestamped notes and preserved logs make the difference between a confident notification and a vague one. Escalate early whenever personal data might be involved; the legal clock may already be running.
Related terms
- Data exfiltration
The unauthorized transfer of data out of an organization, often the attacker's main goal or the leverage behind a ransomware extortion.
- Incident response
The organized process of detecting, analyzing, containing, eradicating and recovering from a security incident, then learning from it.
- Data loss prevention
Controls that detect and block sensitive data, such as card numbers or confidential files, from leaving the organization through email, uploads or devices.
- Insider threat
Risk that comes from people with legitimate access, such as employees or contractors, whether they act maliciously, carelessly or under an attacker's control.