Cyberattack vs Data Breach
A cyberattack is any deliberate attempt to disrupt, damage, or gain unauthorised access to systems, whether or not it succeeds. A data breach is an incident in which data is accessed, disclosed, or exfiltrated without authorisation, whether through an attack, an insider, or a mistake. Many attacks never become breaches, and many breaches come from misconfiguration rather than attack.
What counts as a cyberattack
Cyberattacks include phishing, credential stuffing, ransomware, denial of service, exploitation of vulnerabilities, and supply chain compromises. The defining feature is a deliberate attempt by an adversary. Many attacks are stopped by controls and never reach sensitive systems or data.
What counts as a data breach
A data breach occurs when data is accessed, viewed, copied, altered, or disclosed without authorisation. Causes include attacks, but also publicly exposed storage buckets, misdirected emails, lost devices, and insiders looking at records they should not. The defining feature is the effect on data, not the attacker.
Where they overlap
Many significant breaches begin as attacks: an attacker gains access, escalates privileges, and exfiltrates data. Ransomware often combines encryption with data theft. In these cases the incident is both an attack and a breach, and response must handle both.
Attacks that are not breaches
A denial-of-service attack can take a service offline without touching any data. A blocked phishing campaign or a failed exploitation attempt is an attack without a breach. These still matter for response and reporting, but they do not usually trigger data breach notification duties.
Breaches that are not attacks
An engineer misconfigures a storage bucket as public, an employee emails a spreadsheet to the wrong recipient, or a contractor accesses records out of curiosity. No adversary attacked the system, yet data was exposed. These are breaches and may carry the same notification obligations.
Why the distinction matters
Legal obligations often depend on whether personal data was compromised, not on whether there was an attacker. Response priorities differ too: an attack demands containment and eviction of the adversary; a breach demands scoping exactly which data was affected, for whom, and since when.
Investigating each
Attack investigations focus on initial access, persistence, lateral movement, and indicators of compromise. Breach investigations focus on data access logs, exfiltration evidence, affected records, and timelines. Many incidents need both, and the records should be kept together.
Notification timing
Many laws set deadlines measured in days or hours from when an organisation becomes aware of a breach. Because breaches are confirmed through investigation, teams should start scoping data access as soon as an attack is detected, rather than waiting for the attack response to finish. Early legal involvement helps.
Recording both in one incident
Keep attack and data scoping work in one incident record with a shared timeline. Separate records drift apart, and the questions regulators ask span both.
Language in public statements
Public statements should be precise: say whether data was accessed, which types, and how many people, as far as known. Calling a breach an attack without addressing data, or an attack a breach before scoping, causes confusion and later corrections.
| Aspect | Cyberattack | Data breach |
|---|---|---|
| Defined by | Deliberate attempt by an adversary | Unauthorised access to or disclosure of data |
| Can succeed or fail | Yes | Only exists if data was affected |
| Causes | Phishing, exploits, ransomware, DDoS | Attacks, misconfiguration, insiders, mistakes |
| Typical obligations | Depends on impact and sector | Often notification to regulators and individuals |
| Investigation focus | Access path, persistence, eviction | Which data, whose, since when |
Frequently asked questions
- Is every cyberattack a data breach?
- No. A cyberattack is an attempt to compromise systems, and many are blocked or affect availability without exposing data. It becomes a data breach only if data is accessed, disclosed, or exfiltrated without authorisation. Failed attacks still deserve review, because they show what adversaries are trying.
- Can a data breach happen without a cyberattack?
- Yes. Misconfigured storage, misdirected emails, lost devices, and insiders accessing records without authorisation all cause breaches without any external attacker. These can carry the same legal notification obligations as breaches caused by attacks. Configuration reviews and access monitoring help prevent them.
- Is ransomware a data breach?
- Sometimes. Encryption alone may not expose data, but many ransomware groups also steal data before encrypting it. Regulators in several jurisdictions treat ransomware incidents as potential breaches until investigation shows data was not accessed or exfiltrated. Logs showing what was accessed decide the answer.