What Is a Data Breach? Causes, Costs and Response

"Data breach" is in the headlines constantly, but what actually counts as one — and why are they so expensive? This guide explains the causes, the real costs, and what preparing for one looks like. It's educational background, not legal advice.

What is a data breach?

A data breach is any incident where information is accessed, taken, or disclosed without authorisation. That includes an attacker stealing a customer database, but also an employee emailing a spreadsheet to the wrong person, a lost laptop, or a misconfigured cloud bucket left open to the internet. It doesn't have to involve a hacker — accidental exposure is a breach too.

Common causes

• Stolen or weak credentials. Phished or reused passwords are a leading cause — which is why strong passwords and 2FA matter so much.
• Phishing and social engineering. Tricking a person into granting access.
• Unpatched systems. Known vulnerabilities in internet-facing software.
• Misconfiguration. Cloud storage or databases left publicly accessible.
• Insider mistakes or misuse. Accidental sends, or deliberate misuse of access.
• Ransomware with data theft. Modern attacks steal data before encrypting — see what ransomware is.

Why breaches cost so much

The penalty is only one slice of the cost. Studies consistently find the largest component is lost business — downtime, customer churn and reputational damage — followed by detection, response, legal fees and notification. Regulated data (health, finance) costs far more per record. You can put rough numbers on it with our data breach cost estimator.

A consistent finding: the faster you detect and contain a breach, the less it costs. Speed of response is one of the biggest levers on the final bill.

Notification obligations

Many laws require you to report breaches. Under GDPR, for example, you generally must notify the regulator within 72 hours and, in serious cases, the affected individuals. Other jurisdictions have their own breach-notification rules. Failing to report on time can compound the penalties.

Preventing breaches

• Enforce strong, unique passwords and MFA across the organisation.
• Patch internet-facing systems promptly.
• Encrypt sensitive data at rest and in transit.
• Apply least-privilege access so a single compromised account can't reach everything.
• Train staff to spot phishing.
• Audit cloud configurations for accidental exposure.

Responding to a breach

1. Contain — isolate affected systems to stop the spread.
2. Assess — determine what data was involved and how.
3. Notify — meet your legal reporting deadlines.
4. Remediate — close the gap, rotate credentials and keys.
5. Review — learn from the incident and harden against a repeat.

Make the case for prevention

Prevention is far cheaper than response. Use the breach cost estimator as the "loss" side and the security ROI calculator to justify investing in controls before an incident — not after.