What a Breach Actually Is

"Data breach" shows up in the news constantly, and the phrase sounds dramatic without saying much. Strip away the headline and a breach is one simple thing: information ends up in the wrong hands — accessed, copied, or exposed by someone who was never supposed to have it.

Once you know that, the real question stops being "was there a breach?" and becomes "what was actually taken?" A break-in report that just says "burglary" tells you almost nothing. Whether the thief took loose change, a pile of documents, or the spare keys to the house is what decides how bad it is — and what happens next.

The same is true online. A breach is the moment data leaks; the kind of data that leaked is what makes the story readable. So that is what this page sorts out: what counts as a breach, what tends to get taken, and why a leak matters to Olivia even when it looks like "just" an email address.

What Counts as a Breach?

A breach is unauthorized access to, or exposure of, data. Someone who should not be able to read certain information gets to read it, copy it, or put it somewhere others can. That is the whole definition — the rest is just detail about which data and how much.

In the language from the start of this course, a breach is the confidentiality leg of the CIA triad failing: information meant to be seen by only the right people is now seen by the wrong ones. A leak is the everyday word for it; "breach" is the same idea, usually at a larger scale and usually involving an organization rather than one person.

Notice this is about secrecy being broken, not about anything being damaged. The data Olivia trusted to a service can be perfectly intact and still breached — copied out and sitting somewhere it should never be.

What Gets Taken?

Different data carries different harm, and that is the part headlines flatten. When a service Olivia uses is breached, the records that spill out can be a mix of things, and each kind matters for a different reason.

At the high-harm end are credentials — the usernames and passwords she uses to log in — and payment data like card numbers. These are the obvious prizes, because one leads straight to her accounts and the other straight to her money.

Then there are personal details — her name, email address, phone number — and private messages or files. These feel less alarming. There is no password in a leaked email address, no card number in a chat log. And that is exactly the data people wave off as harmless.

Why "Minor" Data Still Matters

A leaked email address is not the end of the story; it is the start of the next one. On its own it does little. Combined with millions of others, it becomes raw material.

An attacker with Olivia's real name and email can write her a message that looks genuinely like it came from her bank or her delivery service — a far more convincing phishing attempt (a fake message designed to trick her into handing something over) than a generic spam blast. The leaked detail is what makes the lie believable.

Leaked credentials feed a second trick: an attacker takes a password that leaked from one site and tries it on Olivia's other accounts, betting she reused it. This is called credential stuffing, and it only works because old breaches keep handing out password lists. So "low-value" data is rarely low-value for long — small leaks compound into bigger attacks.

A Breach Is the Outcome, Not the Attack

It helps to keep two words apart. The attack is how the data got out — the method, the trick, the flaw that was used. The breach is the result: data that is now exposed. The attack is the break-in; the breach is the missing valuables found afterward.

They usually come together, but not always. A clever attack can be caught before any data leaves, and a breach can happen with no clever attack at all — a database simply left open to the internet by mistake exposes data without anyone breaking in. Keeping the cause and the outcome separate is what lets you read a breach story clearly instead of mashing it into one vague word.