Data Breach: What It Is, How It Happens and How to Avoid It

A data breach occurs when information that should be private — names, emails, passwords, bank details — falls into the wrong hands. In 2026, this is no longer an exception: between September 2025 and January 2026, an average of 47 breaches per month were reported worldwide, from healthcare giants to streaming platforms. This guide explains what it is, how it happens, and how to protect yourself.

TL;DR

• A data breach is any unauthorised access or exposure of confidential information — whether by attack, error, or carelessness.
• The global average cost in 2025 was US$ 4.44 million per incident (IBM report).
• In Brazil, the LGPD requires notification to the ANPD and data subjects within 72 hours.
• AI has changed the game: it accelerates defence but also fuels more convincing attacks.
• Most breaches are preventable with MFA, least privilege, and a tested response plan.

What is a data breach?

A data breach is any event in which confidential information is accessed, copied, exposed, or disclosed without authorisation. It may involve customer data, employee data, or the company's own internal operations. The origin varies widely: an attack on a web application, malware, scraping of poorly protected data, or social engineering.

The central point is the breach of confidentiality. It does not matter whether the data was stolen by a criminal or exposed by a configuration error — if someone who should not have seen it had access, there has been a breach. This distinction is important because many companies only call it a "breach" when an attacker is involved, ignoring that a database accidentally left open in the cloud is equally serious.

Breach, incident, and attack: the differences

These three terms are often treated as synonyms, but they are not:

• Security incident: any event that threatens the confidentiality, integrity, or availability of data. It is the broadest term.
• Attack: the offensive action of a malicious agent — ransomware, phishing, exploitation of a flaw.
• Data breach: the result in which data effectively leaves the organisation's control.

Not every incident becomes a breach, and not every breach starts with a sophisticated attack. Many are born from a storage bucket left public or a credential forgotten in a repository.

What types of data are most frequently breached

Not all data has the same value to a criminal. The most targeted, because they allow direct fraud or blackmail, are:

• Identification data: full name, CPF, RG, and date of birth — the basis for opening fake accounts in the victim's name.
• Access credentials: emails and passwords, especially when reused across multiple services.
• Financial data: card numbers, bank details, and transaction history.
• Health data: medical records and test results, among the most sensitive and also the most expensive on the black market.
• Corporate data: contracts, intellectual property, and strategic information.

The more sensitive the exposed set, the greater the legal and reputational impact of the breach — and the greater the interest of those who resell this information on closed forums.

How a data breach happens

Most cases are not the result of a "genius hacker." They follow repeated patterns, and knowing these entry points already reduces much of the risk. The most common causes are:

1. Stolen or weak credentials — reused passwords and logins without multi-factor authentication remain the number one vector.
2. Phishing and social engineering — messages that trick employees into handing over access or clicking malicious links.
3. Flaws in APIs and web applications — endpoints without proper authentication. This was the case with ServiceNow in June 2026, when a vulnerable API allowed querying customer instance data.
4. Cloud misconfiguration — databases and buckets accidentally exposed publicly.
5. Supply chain attacks — compromising a supplier to reach hundreds of victims at once, as in the wave of NPM packages infected by the Shai-Hulud worm.
6. Insiders — current or former employees with unauthorised access, whether intentional or not.

The threats that dominated 2026

Groups like ShinyHunters and the Qilin ransomware specialised in exfiltrating data and demanding a ransom under threat of publication. The model is no longer just "lock the system" but has become "leak if you don't pay" — the so-called double extortion. Leaking developer credentials has also become routine, as shown by the episode in which a malicious VS Code extension exposed 3,800 repositories on GitHub.

The real cost of a data breach

According to the IBM Cost of a Data Breach 2025 report, the global average cost of a data breach was US$ 4.44 million — a 9% drop from US$ 4.88 million in 2024, the first reduction in five years. The main reason was faster detection and containment with the support of artificial intelligence.

Factor	Cost impact
Global average per incident	US$ 4.44 million
Healthcare sector (highest)	US$ 7.42 million
Heavy use of AI in defence	savings of US$ 1.9 million
Attacks involving AI	present in 16% of cases

But the dollar figure is only part of the bill. There are regulatory fines, loss of customer trust, lawsuits, and the invisible cost of team time — on average, it takes months to fully contain a serious incident. For a small or medium-sized business, a single breach can mean the difference between continuing to operate or closing its doors.

These numbers help to size the problem, but the real impact for each company depends on how long the incident goes unnoticed. The earlier the detection, the smaller the bill — and that is precisely where continuous monitoring and automation make a practical difference in the outcome.

Data breaches in 2026: the cases that defined the year

The year accumulated large-scale episodes that show that size and sector protect no one:

• Telus: the ShinyHunters group claimed to have stolen 700 TB of data from the Canadian operator.
• Under Armour: approximately 72 million accounts exposed.
• Kyushu Electric Power: data of more than 10 million customers affected.
• Novo Nordisk: patient information from clinical trials copied externally without authorisation.
• TVING: the streaming platform confirmed a breach of IDs, names, dates of birth, phone numbers, emails, and passwords.
• Match Group, Fiserv, Cushman & Wakefield and the French national bank account registry also made the list.

Healthcare, energy, finance, and entertainment were equally targeted. The message is direct: no operation is off the radar, and the more sensitive data you hold, the more attractive the target.

What the LGPD requires when a breach occurs

In Brazil, a personal data breach triggers the LGPD (General Data Protection Law) and oversight by the ANPD (National Data Protection Authority). Knowing the obligations prevents a technical problem from also becoming a legal one.

• Notification deadline: the consolidated interpretation requires notifying the ANPD and affected data subjects within 72 hours (3 business days) of becoming aware of the incident. Qualified small businesses have an extended deadline of 30 days.
• Duty to communicate (Art. 48): omitting, delaying, or incompletely notifying is in itself an infringement — regardless of the severity of the breach.
• Content of the notification: nature of the data, data subjects involved, technical measures adopted, and risks to those affected.
• Regulatory agenda 2025–2026: the ANPD plans new rules on artificial intelligence and biometric data. The regulatory net is tightening.

Ignoring these steps is the most expensive mistake a company can make after an incident: it turns a manageable damage into a fine and a reputational crisis.

AI: the new weapon on both sides of the breach

Artificial intelligence has changed the dynamics of data breaches — for better and for worse.

On the defence side, the IBM report shows that organisations that use AI and automation intensively save an average of US$ 1.9 million per incident, mainly because they detect and contain the attack much faster. Detection systems that learn anomalous patterns identify a suspicious access in minutes, not weeks.

On the attack side, AI has become a tool for attackers: it appeared in 16% of breaches analysed, fuelling more convincing phishing campaigns and deepfakes used in fraud. And there is an alert that every company adopting AI needs to hear: 97% of incidents involving AI occurred in organisations without adequate access controls, and 63% had no AI governance policy at all.

The lesson is uncomfortable but necessary: adopting AI without governance does not just accelerate productivity — it creates a new attack surface. Defining who accesses which models and which data is as important as choosing the tool. Connecting an AI assistant to internal databases without logging what it can read is, in practice, opening another door for a future data breach — only this time from inside the house.

How to prevent a data breach in your company

There is no absolute security, but the vast majority of breaches are preventable with basic hygiene and discipline:

1. Enable MFA (multi-factor authentication) on everything. By itself, it stops most credential-based attacks.
2. Apply the principle of least privilege: each person accesses only what they need for their work.
3. Use encryption for data at rest and in transit.
4. Update and monitor your APIs: expose as little as possible and authenticate every call.
5. Train your team against phishing regularly, not once a year.
6. Map your suppliers and require good security practices throughout the chain.
7. Have an incident response plan tested before you need it.

It is worth noting that prevention is not a project with an end date, but a continuous process. Tools change, employees come and go, and each new integration opens a door that did not exist before. Reviewing access every quarter, maintaining backups isolated from the main network, and actively monitoring logs costs much less than containing a data breach once it is already underway.

The first steps after a breach

If the worst happens, the speed and order of actions reduce the damage:

• Contain: isolate affected systems and revoke compromised access immediately.
• Investigate: find out what leaked, when, and through which path.
• Notify: communicate with the ANPD and data subjects within the legal deadline.
• Communicate transparently: silence amplifies reputational damage more than the failure itself.
• Fix the root cause: address what allowed the incident so it does not happen again.

Conclusion: data is a responsibility, not just an asset

Understanding what a data breach is is the first step; treating it as a business priority is what separates resilient companies from those that become headlines. In 2026, with AI accelerating both attacks and defences, and the LGPD demanding responses within 72 hours, protecting data is no longer the exclusive task of the IT team.

At Agathas Web, we build applications and infrastructures with security in mind from the ground up. If your operation handles sensitive data, it is worth reviewing access, APIs, and the response plan now — before an incident forces that conversation at the worst possible moment.