Security Incident vs Data Breach
A security incident is any event that compromises or threatens the confidentiality, integrity, or availability of systems or data. A data breach is a specific kind of incident in which protected data, usually personal data, is actually accessed, disclosed, altered, or lost without authorisation. The distinction matters because breaches carry legal notification obligations that most incidents do not.
The definitions
Security incident. Any event that compromises or threatens the confidentiality, integrity, or availability of information or systems. Phishing emails that reach inboxes, malware blocked on a laptop, a denial-of-service attack, an unauthorised login attempt, and ransomware encrypting servers are all incidents.
Data breach. An incident in which protected data is actually accessed, acquired, disclosed, altered, or destroyed without authorisation. Under privacy laws, the relevant data is usually personal data. Under the GDPR, for example, a personal data breach includes accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data, which means an availability loss such as ransomware destroying the only copy of records can qualify too.
Why the distinction matters
Most incidents are handled internally: contained, investigated, and closed. A breach typically triggers external obligations: notifying regulators, affected individuals, partners, or insurers, often within fixed deadlines that start when the organisation becomes aware of it. Over-classifying wastes effort and creates unnecessary alarm; under-classifying risks missing legal deadlines and penalties.
Making the call
The question is usually whether protected data was actually affected. Answering it requires evidence: access logs showing which records were read, file access records, database audit trails, data transfer volumes, and the attacker's activity timeline. Where evidence is missing, many organisations and regulators treat data as potentially accessed, which can widen notification scope considerably.
Classification is not a one-time decision. An intrusion that looks contained on day one can become a breach on day four when logs show data was taken. Record each classification decision, the evidence behind it, and who made it. Legal counsel should be involved in the determination, because legal definitions differ between laws and jurisdictions.
Preparing before it happens
Write the classification criteria into the incident response plan: which data types count as protected, which laws and contracts apply to them, who decides, and what evidence is needed. Keep a data inventory that maps systems to data types, so responders can tell quickly whether an affected system holds personal or regulated data. Most slow breach decisions are slow because nobody knew what the affected system contained.
| Aspect | Security incident | Data breach |
|---|---|---|
| Scope | Any threat to confidentiality, integrity, or availability | Protected data actually accessed, disclosed, altered, or lost |
| Frequency | Common, often daily | Less common |
| Example | Blocked malware, phishing attempt, DDoS | Customer records exfiltrated, exposed database accessed |
| External obligations | Usually none | Often notification to regulators and individuals |
| Deciding factor | Event affected security | Evidence that protected data was affected |
| Who decides | Security team | Security team with legal and privacy counsel |
Frequently asked questions
- Is every security incident a data breach?
- No. A data breach requires that protected data, usually personal data, was actually accessed, disclosed, altered, or lost without authorisation. Many incidents, such as blocked malware, failed login attempts, or denial-of-service attacks, never affect protected data and are not breaches, though they still need to be handled and recorded.
- Can ransomware be a data breach?
- Often, yes. If attackers exfiltrated data before encrypting it, that is unauthorised access and disclosure. Under some laws, such as the GDPR, loss of availability of personal data can itself be a personal data breach even without theft. Assess what data was affected and involve counsel on notification.
- Who decides whether an incident is a breach?
- Typically the incident response team gathers the evidence, and legal and privacy counsel make or confirm the determination, since breach definitions and notification rules differ between laws and jurisdictions. Record the decision, the evidence, and the time it was made, and revisit it as the investigation develops.
- What is the difference between a hack and a data breach?
- A hack generally means unauthorised access to a system. It becomes a data breach when protected data on that system is actually accessed, disclosed, altered, or lost. A compromised server that holds no personal or regulated data may be a serious incident without being a data breach under privacy laws.