Data Breach: What It Is, How It Happens and How to Prevent It

A data breach occurs when information that should remain private — names, emails, passwords, bank details — falls into the wrong hands. In 2026, this is no longer an exception: between September 2025 and January 2026, an average of 47 breaches per month were reported worldwide, from healthcare giants to streaming platforms. This guide explains what a breach is, how it happens, and how to protect yourself.

TL;DR

• A data breach is any unauthorised access or exposure of confidential information — whether by attack, error or carelessness.
• The global average cost in 2025 was £3.5 million per incident (IBM report).
• In the UK, the ICO must be notified within 72 hours under UK GDPR.
• AI has changed the game: it accelerates defence but also fuels more convincing attacks.
• Most breaches are preventable with MFA, least privilege and a tested incident response plan.

What is a data breach?

A data breach is any event in which confidential information is accessed, copied, exposed or disclosed without authorisation. It can involve customer data, employee data or the company's own internal operations. The origin varies widely: a web application attack, malware, scraping of poorly protected data, or social engineering.

The central point is the breach of confidentiality. It does not matter whether the data was stolen by a criminal or exposed by a configuration error — if someone who should not have seen it gained access, a breach has occurred. This distinction is important because many organisations only call it a "breach" when an attacker is involved, ignoring that a database accidentally left open in the cloud is equally serious.

Breach, incident and attack: the differences

These three terms are often used interchangeably, but they are not:

• Security incident: any event that threatens the confidentiality, integrity or availability of data. It is the broadest term.
• Attack: the offensive action of a malicious actor — ransomware, phishing, exploitation of a vulnerability.
• Data breach: the result where data effectively leaves the organisation's control.

Not every incident becomes a breach, and not every breach starts with a sophisticated attack. Many are born from a storage bucket left public or a credential forgotten in a repository.

What types of data are most commonly breached

Not all data has the same value to a criminal. The most targeted, because they enable direct fraud or blackmail, are:

• Identification data: full name, National Insurance number, date of birth — the basis for opening fake accounts in the victim's name.
• Access credentials: emails and passwords, especially when reused across multiple services.
• Financial data: card numbers, bank account details and transaction history.
• Health data: medical records and test results, among the most sensitive and also the most expensive on the black market.
• Corporate data: contracts, intellectual property and strategic information.

The more sensitive the exposed data set, the greater the legal and reputational impact of the breach — and the greater the interest of those who resell this information on closed forums.

How a data breach happens

Most cases are not the result of a "genius hacker". They follow repeated patterns, and knowing these entry points already reduces much of the risk. The most common causes are:

1. Stolen or weak credentials — reused passwords and logins without multi-factor authentication remain the number one vector.
2. Phishing and social engineering — messages that trick employees into handing over access or clicking malicious links.
3. API and web application vulnerabilities — endpoints without proper authentication. This was the case with ServiceNow in June 2026, when a vulnerable API allowed querying customer instance data.
4. Cloud misconfiguration — databases and buckets accidentally exposed to the public.
5. Supply chain attacks — compromising a supplier to reach hundreds of victims at once, as in the wave of NPM packages infected by the Shai-Hulud worm.
6. Insiders — employees or former employees with unauthorised access, whether intentional or accidental.

Threats that dominated 2026

Groups like ShinyHunters and the Qilin ransomware have specialised in exfiltrating data and demanding a ransom under threat of publication. The model has shifted from just "locking the system" to "leak if you don't pay" — so-called double extortion. Leaking developer credentials has also become routine, as shown by the episode where a malicious VS Code extension exposed 3,800 repositories on GitHub.

The real cost of a data breach

According to IBM's Cost of a Data Breach 2025 report, the global average cost of a data breach was £3.5 million — a 9% decrease from the £3.8 million in 2024, the first reduction in five years. The main reason was faster detection and containment with the help of artificial intelligence.

Factor	Cost impact
Global average per incident	£3.5 million
Healthcare sector (highest)	£5.8 million
Extensive use of AI in defence	saving of £1.5 million
Attacks involving AI	present in 16% of cases

But the pound sign is only part of the bill. There are regulatory fines from the ICO, loss of customer trust, legal action and the invisible cost of staff time — on average, it takes months to fully contain a serious incident. For a small or medium-sized business, a single breach can mean the difference between continuing to operate or closing its doors.

These figures help to size up the problem, but the real impact for each company depends on how long the incident goes unnoticed. The earlier the detection, the smaller the bill — and it is precisely here that continuous monitoring and automation make a practical difference to the outcome.

Data breaches in 2026: the cases that defined the year

The year accumulated large-scale episodes that show that size and sector protect no one:

• Telus: the ShinyHunters group claimed to have stolen 700 TB of data from the Canadian operator.
• Under Armour: around 72 million accounts exposed.
• Kyushu Electric Power: data of more than 10 million customers affected.
• Novo Nordisk: patient information from clinical trials copied externally without authorisation.
• TVING: the streaming platform confirmed a breach of IDs, names, dates of birth, phone numbers, emails and passwords.
• Match Group, Fiserv, Cushman & Wakefield and the French national bank account register also made the list.

Healthcare, energy, finance and entertainment were equally targeted. The message is clear: no operation is off the radar, and the more sensitive data you hold, the more attractive the target.

What UK GDPR requires when a breach occurs

In the UK, a personal data breach triggers the UK GDPR (Data Protection Act 2018) and oversight by the ICO (Information Commissioner's Office). Knowing the obligations prevents a technical problem from becoming a legal one.

• Notification deadline: the ICO must be notified within 72 hours of becoming aware of the incident. Affected individuals must also be informed without undue delay if the breach poses a risk to their rights and freedoms.
• Duty to report (Article 33): failing to notify, delaying or providing incomplete information is in itself an infringement — regardless of the severity of the breach.
• Content of the notification: nature of the data, categories of data subjects, measures taken and risks to those affected.
• Regulatory outlook 2025–2026: the ICO is expected to issue new guidance on AI and biometric data. The regulatory net is tightening.

Ignoring these steps is the most expensive mistake a company can make after an incident: it turns a manageable problem into fines and a reputational crisis.

AI: the new weapon on both sides of a breach

Artificial intelligence has changed the dynamics of data breaches — for good and for ill.

On the defence side, the IBM report shows that organisations using AI and automation extensively save an average of £1.5 million per incident, mainly because they detect and contain the attack much faster. Detection systems that learn anomalous patterns identify suspicious access in minutes, not weeks.

On the attack side, AI has become a tool for intruders: it appeared in 16% of breaches analysed, powering more convincing phishing campaigns and deepfakes used in fraud. And there is a warning that every company adopting AI needs to hear: 97% of incidents involving AI occurred in organisations without adequate access controls, and 63% had no AI governance policy at all.

The lesson is uncomfortable but necessary: adopting AI without governance does not just accelerate productivity — it creates a new attack surface. Defining who can access which models and which data is as important as choosing the tool. Connecting an AI assistant to internal databases without logging what it can read is, in practice, opening another door to a future data breach — only this time from inside the house.

How to prevent a data breach in your company

There is no absolute security, but the vast majority of breaches are preventable with basic hygiene and discipline:

1. Enable MFA (multi-factor authentication) everywhere. On its own, it stops most credential-based attacks.
2. Apply the principle of least privilege: each person accesses only what they need for their job.
3. Use encryption for data at rest and in transit.
4. Update and monitor your APIs: expose as little as possible and authenticate every call.
5. Train your staff against phishing regularly, not once a year.
6. Map your suppliers and demand good security practices throughout the supply chain.
7. Have an incident response plan tested before you need it.

It is worth noting that prevention is not a project with an end date, but a continuous process. Tools change, employees come and go, and each new integration opens a door that did not exist before. Reviewing access every quarter, maintaining backups isolated from the main network, and actively monitoring logs costs far less than containing a data breach once it is underway.

First steps after a breach

If the worst happens, the speed and order of actions reduce the damage:

• Contain: isolate affected systems and revoke compromised access immediately.
• Investigate: find out what leaked, when and through which route.
• Notify: inform the ICO and affected individuals within the legal timeframe.
• Communicate transparently: silence amplifies reputational damage more than the failure itself.
• Fix the root cause: address what allowed the incident so it does not happen again.

Conclusion: data is a responsibility, not just an asset

Understanding what a data breach is is the first step; treating it as a business priority is what separates resilient companies from those that become headlines. In 2026, with AI accelerating both attacks and defences, and UK GDPR demanding responses within 72 hours, protecting data is no longer the sole task of the IT team.

At Agathas Web, we build applications and infrastructures with security in mind from the design stage. If your operation handles sensitive data, it is worth reviewing access, APIs and the response plan now — before an incident forces that conversation at the worst possible moment.