Data Breach

Understand how data breaches happen, why identity is the root cause, and how governance and access controls help prevent them.

Talk to our experts

See how it works

Last Updated date: June 2026

The Short Answer

A data breach is a security incident in which an unauthorized party gains access to sensitive, confidential, or protected information without the knowledge or consent of the data owner. The exposed data may be copied, stolen, altered, or publicly disclosed.

Data breaches are not isolated technical failures. They are the downstream consequence of identity and access control gaps, weak credentials, over-provisioned accounts, or unmonitored access paths that attackers exploit.

At a Glance

Quick Summary
Field	Detail
Category	Cybersecurity incident / Identity risk
Related to	IAM, Identity Governance (IGA), Zero Trust, Least Privilege
Primary cause	Compromised credentials, phishing, and misconfigured access
Average US cost (2025)	$10.22 million per incident
Time to detect	Up to 300 days for credential-based attacks

Why Data Breaches Are an Identity Problem

Most breaches do not begin with a sophisticated zero-day exploit. They begin with an identity.

In many cases, compromised credentials and privilege misuse sit at the core of modern breaches. Once an attacker gains access to a valid username and password through phishing, credential stuffing, or social engineering, they can move through systems as if they are a legitimate user. At that point, traditional perimeter defenses struggle to tell the difference between an attacker and an employee.

This is why preventing data breaches is closely tied to identity governance. Organizations that enforce least-privilege access, continuously review permissions, and monitor for unusual access behavior are able to detect and contain breaches faster, and in many cases, prevent them altogether.

How a Data Breach Unfolds

While the entry point may vary, most breaches follow a similar progression.

Initial access
The attacker gains entry through phishing, stolen credentials, an unpatched vulnerability, or a misconfigured cloud resource.
Lateral movement
With a compromised identity, the attacker moves across systems and attempts to escalate privileges wherever possible.
Data discovery
The attacker identifies valuable data such as customer records, financial information, health records, or intellectual property.
Exfiltration or encryption
The data is either stolen and sold or encrypted as part of a ransomware attack.
Detection
The organization eventually discovers the breach, often weeks or months after the initial compromise.

Credential-based attacks, which are the most common, can take close to 300 days to detect and contain according to IBM’s Cost of a Data Breach report. The longer an attacker remains undetected, the greater the impact.

What Gets Exposed in a Data Breach

Not all breaches target the same types of data, but certain categories are repeatedly exposed.

Personally identifiable information (PII)
Names, addresses, Social Security numbers, and national IDs.
Financial data
Credit card numbers, bank account details, and payment records.
Healthcare records
Diagnoses, prescriptions, and insurance data classified as PHI under HIPAA.
Login credentials
Usernames, passwords, session tokens, and API keys.
Intellectual property
Source code, trade secrets, and internal communications.

Each type of data comes with its own regulatory implications. For example, healthcare breaches trigger HIPAA obligations, breaches involving EU residents fall under GDPR, and financial data exposure may invoke PCI DSS requirements.

The Access Control Failures Behind Most Breaches

When you look at breaches through an identity lens, clear patterns start to emerge.

Weak or reused credentials make phishing and credential stuffing highly effective. Enforcing MFA significantly reduces this risk.

Overprivileged accounts create a larger attack surface. If one account is compromised, the attacker may gain access to far more than necessary. Least-privilege models help contain this.

Access rights often accumulate over time. Employees change roles, contractors leave, and accounts are not always deprovisioned. Identity governance platforms help automate access reviews and close these gaps.

Misconfigured cloud environments can leave databases or storage buckets exposed without proper authentication. Cloud entitlement management helps identify and fix these issues.

Insider threats, whether intentional or accidental, contribute to roughly 20 percent of breaches. Behavioral monitoring and separation of duties are key controls here.

The Cost of a Data Breach

The financial impact of a breach goes far beyond the initial incident.

Average US breach cost in 2025 stands at $10.22 million per incident.
Business email compromise alone accounts for over $2.9 billion in annual losses.
GDPR fines can reach up to 4 percent of global annual revenue.
Reputational damage often leads to long-term customer loss and reduced trust.

One of the biggest factors influencing cost is how quickly a breach is detected and contained. Organizations with strong identity governance and automated access controls tend to respond faster, which helps reduce both financial and regulatory impact.

Data Breaches by Industry

Different industries face different types of breach risks.

Healthcare organizations experience the highest cost per record because patient data combines personal, financial, and medical information. HIPAA requires breach notification within 60 days of discovery.

Financial services organizations face both direct financial theft and strict regulatory oversight under frameworks like PCI DSS and SOX. Credential theft and insider fraud are common attack vectors.

SaaS and technology companies manage large volumes of customer data in shared environments. Misconfigured cloud storage, weak tenant isolation, and exposed API keys are frequent entry points for attackers.

Data Breach vs. Data Leak vs. Data Exposure

These terms are often used interchangeably but describe distinct events.

Term	Definition	Intent
Data breach	Unauthorized access to protected data	Deliberate attack or exploitation
Data leak	Accidental internal disclosure of sensitive data	Unintentional, no external attacker required
Data exposure	Data left accessible without protection (e.g., open S3 bucket)	Neither deliberate nor necessarily accessed

A data exposure becomes a breach the moment an unauthorized party accesses the exposed data. Many organizations discover a breach only after investigating what began as an exposure.

Preventing Data Breaches: The Identity-First Approach

Effective prevention starts with controlling access and continuously validating that it remains appropriate.

Authentication hardening
Enforce MFA across all systems, especially for privileged accounts. Remove shared accounts and default credentials. Adopt phishing-resistant authentication methods such as passkeys and FIDO2.
Access governance
Apply least-privilege access so users only have what they need. Run automated access certification campaigns to remove unnecessary permissions. Immediately deprovision access when users leave the organization.
Monitoring and detection
Use identity threat detection to identify unusual access behavior. Integrate SIEM and UEBA tools to correlate activity with threat signals. Maintain a clear incident response plan with defined notification timelines.
Infrastructure hygiene
Patch systems regularly to eliminate known vulnerabilities. Audit cloud environments for exposed storage and misconfigurations. Conduct penetration testing focused on identity-based attack paths.

The Hardest Parts of Breach Prevention

Even well-established security programs face ongoing challenges.

Access tends to accumulate as users change roles, and manual reviews are often inconsistent. Automated governance is the only scalable way to manage this.

Third-party and contractor access is often less controlled than internal users. Incidents like SolarWinds highlight the risks of trusted external access.

Detection delays remain a major issue. Credential-based breaches can go unnoticed for months, allowing attackers to blend into normal activity.

Finally, there is always a balance to strike between security and productivity. Overly restrictive controls can lead to workarounds, while identity governance enables more precise, role-based access without unnecessary friction.

Frequently Asked Questions

A data breach happens when someone gains unauthorized access to private data. This can affect individuals or entire organizations and is often preventable with proper access controls.

Phishing and stolen credentials are the leading causes. Other factors include unpatched vulnerabilities, misconfigured cloud environments, ransomware, and insider threats. Weak or reused passwords continue to play a major role.

On average, it takes about 194 days to detect a breach and another 64 days to contain it. Credential-based attacks can take even longer, sometimes approaching 300 days.

GDPR requires notification within 72 hours for affected EU residents. HIPAA requires notification within 60 days for healthcare data in the US. Many US states have additional requirements.

Identity governance significantly reduces risk by enforcing least-privilege access, automating reviews, and detecting abnormal behavior. While it cannot eliminate all risk, it addresses the most common causes of breaches.

A cyberattack is the method used, while a data breach is the outcome. Not all attacks lead to data exposure, and not all breaches are caused by external attacks.