A data breach is an incident in which confidential, protected or personal information is accessed, disclosed, copied, altered or lost without authorisation. Breaches can result from cyber attacks, insiders misusing access, lost devices, or simple mistakes such as sending a file to the wrong person or leaving a database open to the internet. Banks, payment firms, regulators and any organisation holding customer records are exposed.
The term overlaps with, but is narrower than, a security incident: every breach is an incident, but not every incident exposes data. Data protection laws, such as the European Union's General Data Protection Regulation (GDPR) and US state breach-notification statutes, define a "personal data breach" and require organisations to report serious ones. In finance, a breach can expose personally identifiable information, card numbers, account credentials and confidential documents submitted to regulators.
Data breach in plain terms
Imagine a doctor's surgery that keeps patient files in a cabinet. A breach is any time those files end up with someone who should not have them: a thief picks the lock, a receptionist takes copies home, or the cabinet is left open in a public corridor overnight.
It does not matter whether anyone has yet misused the files. Once they are out of the owner's control, the surgery has to work out what was taken, tell the people affected so they can protect themselves, and fix whatever let it happen.
Common causes
- Stolen or weak credentials. Attackers log in with passwords obtained through social engineering or earlier leaks, often enabling account takeover.
- Unpatched software. Known flaws in web applications or servers are exploited before fixes are applied, a risk reduced by security hardening.
- Misconfiguration. Cloud storage, databases or portals are left publicly reachable or with broken access checks.
- Malware and extortion. Ransomware groups now commonly copy data before encrypting systems and threaten to publish it.
- Insiders and third parties. Employees, contractors or vendors with legitimate access misuse it or are themselves compromised.
Notification and legal duties
Under the GDPR, an organisation must notify its data protection supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms (Article 33). If the risk to individuals is high, they must be told directly as well (Article 34). Every US state has its own breach-notification law, with differing definitions and deadlines, and sector rules add further duties. US public companies must disclose material cybersecurity incidents to investors under Securities and Exchange Commission rules adopted in 2023.
Financial firms usually also have to inform their prudential or conduct regulator, card networks if card data is involved, and banking partners. Failure to protect data or to report on time can lead to fines and enforcement actions, as well as lawsuits from affected customers.
Notable cases
The 2017 breach at the US credit bureau Equifax exposed personal data of about 147 million people after attackers exploited an unpatched web application; in 2019 Equifax agreed a settlement with US federal and state authorities that could reach up to about $700 million. In 2019, Capital One disclosed that a misconfigured cloud environment had allowed an outsider to obtain data on roughly 100 million people in the United States.
Regulators can be breached too. In 2026 the Curaçao Gaming Authority (CGA) confirmed unauthorised access to its online licensing portal over a period of roughly nine months, after a security researcher had registered on the portal under a false identity. Files from licence applications, reported to include ownership and source-of-wealth documents for operators behind many offshore-licensed gambling sites, were later published by journalists. The regulator retired the portal and moved to a replacement system. The case showed that confidential beneficial ownership information held by a licensing body can become public, with consequences for licence holders' banking relationships.
Impact on financial services
Beyond fines and legal costs, a breach damages trust. Banks and payment partners may review or end relationships with an affected firm, a form of de-risking, especially if the leaked material reveals weak controls or unclear ultimate beneficial owners. Stolen data fuels further crime: identity verification can be defeated with leaked documents, and stolen card data feeds card-not-present fraud. Firms reduce exposure by holding less data, strong encryption, multi-factor authentication, monitoring through a security operation center, and a tested incident-response plan, all part of managing operational risk and data privacy.