What is a data breach? What it means and how to protect your business

Key takeaways:

• A data breach happens when an unauthorized party accesses or exposes sensitive data, including login credentials, customer records, or payment details.
• Common causes include phishing, stolen passwords, malware, human error, and unpatched software.
• Strong prevention combines MFA, unique passwords, software updates, SSL/HTTPS encryption, security monitoring, and reliable backups.

Your personal information is more valuable than you think, and cybercriminals know it.

Every time you shop online, create an account, or share personal data with a business, that information is stored on a server somewhere. It may include bank account numbers, financial data, login details, or other sensitive information. If those servers are compromised, millions of people can be affected in a short time.

So, what is a data breach? This guide explains what it means, why it matters, how breaches happen, and what businesses can do to prevent them and respond if one occurs.

What is a data breach?

A data breach is a security incident in which sensitive, protected, or confidential information is accessed, disclosed, stolen, or shared without authorization. It can happen through hacking, accidental exposure, insider misuse, or a simple system misconfiguration. However it happens, the result is the same: private information ends up in the wrong hands.

When a data breach occurs, an unauthorized party gains access to protected information that may include personally identifiable information, personal details, or financial records.

Recent reports show how widespread the problem is. The Identity Theft Resource Center (ITRC) tracked 1,803 data compromises in the first half of 2026, resulting in an estimated 471.2 million victim notices. Verizon’s 2026 Data Breach Investigations Report analyzed more than 22,000 confirmed data breaches across 145 countries.

For websites with user accounts, data breaches usually involve information like:

• Names
• Email addresses
• Usernames and passwords
• Home addresses
• Birthdates
• Social Security numbers
• Driver’s license numbers
• Passport numbers
• Bank account or payment details

Data breaches can also be expensive. IBM’s 2026 Cost of a Data Breach Report puts the global average cost at $4.99 million, while the U.S. average reached $11.5 million. For a small business, the total may look very different, but recovery costs, downtime, lost customers, and damaged trust can still hit hard.

If customers trust you with their personal data, protecting it is part of protecting your business. A breach can put both at risk.

Some of the biggest data breaches in U.S. history

These major U.S. data breaches show how a cyberattack can expose customer records, medical records, and other sensitive information.

Conduent (2024–2025)

The Conduent data breach began in October 2024 and continued into January 2025, exposing customer records and other sensitive information. Updated regulatory reporting puts the number of affected individuals at more than 62 million.

Compromised data included names, Social Security numbers, financial information, medical information, and health insurance details. The scale of the breach also prompted regulatory investigations into Conduent’s security practices and handling of protected information.

Yale New Haven Health System (YNHHS) (2025)

In March 2025, Yale New Haven Health System discovered a data breach that affected more than 5 million people. An unauthorized third party accessed its network and copied data that could include names, contact details, dates of birth, race or ethnicity, Social Security numbers, patient types, and medical record numbers.

Yale New Haven said its electronic medical records and financial information were not accessed. The incident led to class-action litigation, with an $18 million settlement receiving final court approval in March 2026.

Progress Software–MOVEit vulnerability (2023–2024)

In May 2023, cybercriminals exploited a zero-day SQL injection vulnerability in Progress Software’s MOVEit Transfer product, allowing them to access customer environments and steal data. Progress later confirmed that a threat actor exfiltrated personal data from affected systems.

The cyber attack ultimately affected at least 2,773 organizations and nearly 95.8 million people worldwide. Emsisoft estimated the potential cost at about $15.8 billion, although this was not a measure of confirmed financial losses.

AT&T (2024)

In July 2024, AT&T disclosed that attackers had downloaded call and text records tied to about 109 million customer accounts from its workspace on a third-party cloud platform. The data covered nearly all AT&T wireless customers and some customers using its network through other providers.

AT&T said Social Security numbers, dates of birth, and message contents were not exposed, but the records could reveal who affected individuals communicated with and, in some cases, approximate location information.

DentaQuest (2026)

In May 2026, dental and vision benefits provider DentaQuest discovered that unauthorized individuals had accessed data on its network. The U.S. Department of Health and Human Services lists the hacking/IT incident as affecting 15 million people.

Exposed information could include names, Social Security numbers, member IDs, Medicaid and Medicare numbers, and dental or vision health information such as diagnoses, treatments, and billing details.

Data breach vs. security breach: What’s the difference?

These two terms are often used interchangeably, but they mean different things.

• A security breach happens when someone bypasses security controls and gains unauthorized access to a system, network, or account beyond what authorized users are allowed to access.
• A data breach occurs when sensitive data or intellectual property is accessed, exposed, or stolen.

	Security breach	Data breach
Simple definition	Unauthorized access to a system, network, or account	Sensitive data is accessed, exposed, or stolen
What’s affected	Systems, apps, logins, and infrastructure	Personal information, financial data, corporate data, customer records, and credentials
What it looks like	Someone gets into your admin panel, server, or email account	Data gets viewed, downloaded, leaked, or shared publicly
Impact	Security risk increases, but damage may be limited if caught early	Sensitive information is directly exposed, which may trigger notifications, legal steps, and reputational harm
Can it happen without the other?	Yes. Someone gains access, but no sensitive data is taken	Yes. Data can be exposed accidentally, such as through a public database, without someone hacking the system

Here’s one way to look at it: a security breach is like someone breaking into your building. A data breach is when that person actually gets their hands on your files. Strong monitoring, access management, and other data protection measures can help you catch a security breach before sensitive information is stolen.

Read our What is website security? Beginner’s guide to protecting your site for more information.

Types of data breaches

Knowing the different types of data breaches can help you recognize common risks and strengthen your prevention plan.

Breach type	Definition	Example
Hacking or malware	External attackers exploit known vulnerabilities or use malicious software to access systems and steal data.	Ransomware encrypts company files and steals copies of customer data for financial gain.
Phishing and social engineering	Social engineering attacks trick users into revealing credentials or downloading malware.	A fake “account verification” email steals employee logins to business email, then attackers pivot into CRM data.
Credential-based attacks	Stolen, reused, or weak passwords are used to log into accounts directly.	Attackers try leaked username-password pairs across banking or SaaS logins until one works.
Insider breaches	Employees or contractors misuse their access, either deliberately or through human error.	An employee downloads sensitive customer data to a personal device and later loses it.
Lost or stolen devices	Laptops, phones, USB drives, or hard drives with sensitive data go missing.	An unencrypted laptop with thousands of patient records is stolen from a car.
Misconfiguration/accidental exposure	Databases or cloud storage are left open to the internet without proper access controls.	A cloud storage bucket with customer invoices is indexed and scraped by bots.
Third-party/vendor breaches	A supplier, partner, or service provider is breached, and attackers access your data through them.	A payment processor is hacked, exposing card details from hundreds of online stores.

AI and data breaches

AI tools can create new ways for sensitive information to be exposed, especially when employees use them without clear rules. For example, someone might paste customer records, financial details, internal documents, or login information into an AI chatbot to speed up a task. If that tool stores or processes the information outside your approved systems, the data may leave your control.

AI tools can also create risk when they have access to more business data than they need. A poorly configured integration, overly broad permissions, or incorrect output could expose information to people who should not see it.

For small businesses, the best approach is to set clear rules around what employees can share with AI tools, use approved platforms, limit permissions, and review how AI services handle and retain business data before using them with sensitive information.

How do data breaches happen?

So, how do data breaches happen? Most attackers follow a familiar three-step pattern:

1. They research the target
2. They choose an attack method
3. They extract the data

Step 1: They research the target

Before attacking, cybercriminals often study how your business operates and look for possible entry points. They may check:

• Which employees or roles they can impersonate
• What software your website uses, including its CMS, plugins, and login portals
• Where your data is stored, such as cloud platforms, servers, or third-party tools
• Public clues such as exposed admin pages, error messages, or outdated software

Step 2: They choose an attack method

Once attackers identify the easiest way in, they choose an attack method that targets either your systems or your people:

• Technical attacks: Exploiting software vulnerabilities, exposed services, weak configurations, or outdated systems to gain access
• Social engineering attacks: Using phishing attacks, impersonation, or other tactics to trick employees into sharing credentials, opening malicious files, or installing data-stealing malware

Step 3: They extract the data

After gaining access, attackers try to remove or expose the data. This data exfiltration or data leakage can happen by:

• Copying databases or exporting files
• Pulling customer records through compromised admin panels
• Using malware to transfer data remotely
• Leaking small amounts of information over time to blend in with normal network activity

Continuous monitoring can help businesses spot unusual activity sooner and respond before more data is exposed.

What are the damages a data breach could do?

A data breach can do more than expose information. The damage can affect both individuals and businesses.

For individuals

When personal data is compromised, the consequences can be severe and long-lasting. Identity theft can lead to criminals opening credit cards, taking out loans, or filing tax returns in your name. Financial fraud can drain bank accounts or create unauthorized charges before victims notice.

Breaches can also lead to targeted phishing attacks, as criminals use stolen personal details to make scams look more convincing. In some cases, victims may spend months resolving fraudulent accounts, restoring credit, and securing compromised information.

For businesses

If you run a small business, a data breach can hit your finances, reputation, and daily operations at the same time. Costs may include customer notifications, legal counsel, regulatory fines, recovery work, and lost revenue during downtime. While the U.S. average breach cost is far higher than what most small businesses will face, losing a few key clients or shutting down for even a short period can still hurt.

A breach can also damage customer trust and expose security risks that attackers may try to exploit again. The faster you identify and address those weaknesses, the better your chances of limiting further damage.

How to prevent data breaches?

Good data breach prevention starts with a few practical safeguards. Small businesses can prevent data breaches by strengthening accounts, software, data, and day-to-day security habits:

• Use strong passwords and enable multi-factor authentication (MFA)
• Keep your software updated
• Encrypt your data with SSL/TLS
• Scan for malware and vulnerabilities regularly
• Use data loss prevention (DLP) tools
• Back up your website and test restores
• Train your staff and reduce access risk
• Conduct regular security assessments

Use strong passwords and enable multi-factor authentication (MFA)

Strong passwords make it harder for attackers to break into your accounts. Use long, unique passwords for every login, avoid reusing them across services, and consider a password manager to keep track of them securely. This can reduce the risk from brute force attacks and stolen credentials.

Multi-factor authentication (MFA) adds an extra layer of security by requiring another form of verification after your password. This could be a code from an authenticator app, a security key, or another approved method. Even if an attacker gets your password, MFA makes it much harder for them to access the account.

Keep your software updated

Outdated software can leave known security gaps open for attackers. Make it a habit to update software such as your content management system (CMS), themes, plugins, and other tools as soon as security patches become available.

Remove anything you no longer use and limit admin access to people who need it. For small businesses, this is a low-cost, low-effort way to reduce risk without needing a large security budget or dedicated IT staff.

Encrypt your data with SSL/TLS

If your website collects login details, payment information, or form submissions, SSL/TLS encryption helps protect sensitive data while it travels between a visitor’s browser and your website. An SSL certificate enables HTTPS, creating an encrypted connection that makes intercepted information difficult for attackers to read.

For small businesses, this is a practical way to encrypt sensitive data without adding complexity to the customer experience. It also helps protect information customers share with you, such as passwords, contact details, and payment data, while it moves across the internet.

Scan for malware and vulnerabilities regularly

Regular malware and vulnerability scans help you find security vulnerabilities and suspicious activity before they turn into a larger problem. Scans can flag malicious code, outdated software, exposed files, or other weaknesses attackers could exploit.

Automated daily scanning can make this easier for small businesses by reducing the need for constant manual checks. Use a trusted website security tool to scan your site regularly and review alerts as soon as they appear.

Use data loss prevention (DLP) tools

Data loss prevention (DLP) tools help monitor and control how sensitive information moves across your network. They can block unauthorized transfers, flag risky activity, and limit access to data based on user roles or policies.

Enterprise options include Symantec, Forcepoint, and Microsoft Purview, but smaller businesses may not need a dedicated platform. Many standard endpoint protection tools also include DLP capabilities that can help reduce accidental data exposure and unauthorized sharing.

Back up your website and test restores

Backups can’t stop a data breach from happening, but they can help your business recover if you face downtime, defacement, or data loss. Make sure to back up regularly, keep copies in different places, and test your backups to be sure they work when you need them.

Train your staff and reduce access risk

Human error can lead to data breaches, especially when employees are not prepared to spot common threats. Train employees to recognize phishing attempts and impersonation, use MFA, avoid password reuse, and report suspicious activity quickly. For a small business, even a short training session or simple security checklist can reduce risk without the cost of a formal enterprise program.

Training also works best when your team knows what to do after an incident. Create a data breach response plan and make sure employees understand their role if a breach occurs.

Conduct regular security assessments

Regular security assessments help you find weaknesses before attackers can exploit them. Use vulnerability scans and penetration testing to check your systems, especially after major changes such as new software, system migrations, or staff changes.

These assessments can also show whether your current security controls are working as intended and whether your practices meet relevant industry standards. For small businesses, scheduling them regularly can help catch problems before they lead to a breach.

What to do if you’re part of a data breach

Even with strong precautions, breaches can happen. If your or your customers’ data is exposed, act quickly and methodically.

• Find out what information was exposed
• Change passwords immediately
• Inform your organization and your users
• Monitor financial accounts and protect credit
• Watch for phishing “aftershocks”
• Report to the appropriate authorities
• Consider identity theft protection services

Find out what information was exposed

Start by identifying what information was compromised. Read the data breach notification carefully and check which systems and types of data were affected, such as passwords, payment information, Social Security numbers, or other regulated data. Understanding what happened to the victim’s data can help you decide what steps to take next.

For individuals, the free tool Have I Been Pwned lets you enter your email address and check whether it has appeared in a known breach database.

Change passwords immediately

Change affected login credentials right away, starting with admin and other high-access accounts. Require password resets for any users whose accounts may have been exposed, and enable multi-factor authentication (MFA) if it isn’t already active.

Stolen credentials can also be reused against other accounts, so unique passwords matter. If the same password was used elsewhere, change it there too. You can also limit repeated login attempts to reduce the risk of attackers trying exposed credentials again.

Inform your organization and your users

Coordinate internally with IT, legal, leadership, and customer support. Follow all notification requirements relevant to your industry and state. When communicating with customers, use clear, calm messaging that explains what happened, what was affected, and what steps they should take.

Monitor financial accounts and protect credit

Encourage affected customers to monitor their bank and credit card accounts for unfamiliar charges or other suspicious activity. If sensitive information such as Social Security numbers was exposed, they can also consider placing a fraud alert or credit freeze on their credit reports.

A fraud alert asks creditors to verify identity before opening new accounts, while a credit freeze blocks new credit accounts from being opened. Both can help reduce the risk of identity theft after a breach.

Watch for phishing “aftershocks”

After a breach, phishing activity spikes. Attackers use stolen data to craft more convincing, targeted scams. Be extra vigilant about unsolicited emails, calls, or texts claiming to be from affected companies, banks, or government agencies. When in doubt, navigate directly to official websites rather than clicking any links.

Read our guide on What is Phishing? How it Works and Tips to Protect Yourself for more information.

Report to the appropriate authorities

For identity theft and financial fraud, file a report with the Federal Trade Commission (FTC). It will also generate a personalized recovery plan. For broader cybercrime, the FBI’s Internet Crime Complaint Center (IC3) accepts reports. Your state attorney general’s office may also have state-specific resources and requirements.

Businesses may also need to notify affected customers and regulators within specific time frames. For example, the GDPR can require regulator notification within 72 hours, while HIPAA generally requires certain breach notifications without unreasonable delay and no later than 60 days. Requirements vary by location, industry, and breach, so consult legal counsel about your specific obligations.

Consider identity theft protection services

Identity theft protection services can monitor your personal information across credit bureaus, public records, and the dark web for signs of misuse. Services such as Aura, LifeLock, and IdentityForce may also provide alerts, identity recovery support, and insurance coverage, depending on the plan.

If Social Security numbers, financial information, or other sensitive details were exposed in a breach, this type of monitoring can help you spot suspicious activity sooner and respond before further damage occurs.

Frequently asked questions

Stop breaches before they start

Data breaches often begin with security gaps that you can address before they cause serious damage. For small businesses, the goal is to stay ahead of cyber criminals by reducing those gaps and responding quickly when something looks wrong.

You also don’t need a large IT team or enterprise budget to strengthen your defenses. Network Solutions security tools put enterprise-grade protection within reach for small businesses. Our web hosting services include malware scanning and reliable support to help protect your site day to day, while free apps included with every Network Solutions purchase give you more tools to support your business as it grows.

Meta title:
Meta description: What is a data breach? See how breaches happen, the damage they can cause, and how to protect your business. Read the guide.