IT explained · 8 min read
What is a data breach? How they happen and what to do first
Written for: IT managers, business owners and support teams who need a clear working definition and a first-hours plan rather than a compliance essay.
How a breach unfolds
In short
A data breach is any incident where information you hold is accessed, copied, altered or exposed by someone who should not have it. Most breaches begin unglamorously, with stolen credentials, an unpatched internet-facing service or a misconfigured share, and most are discovered long after the initial access. The controls that reduce damage most are the dull ones: multi-factor authentication, patching, least privilege and tested backups.
Key takeaways
- A breach is unauthorised access to data. It does not require theft, ransomware or a public leak to qualify.
- Most breaches start with credentials, an unpatched internet-facing service, or a misconfiguration, not a novel exploit.
- The gap between access and discovery is measured in weeks or months, which is why detection matters as much as prevention.
- In the first hours, preserve evidence before cleaning up. Reimaging a machine destroys what you need to know how far it went.
- In the UK and EU, a reportable personal-data breach carries a 72-hour notification clock from the point of awareness.
Breach, incident and leak
Precision helps here because the words carry different consequences. A security incident is anything that might have compromised confidentiality, integrity or availability. A breach is an incident where unauthorised access actually happened. A leak usually means data exposed by accident rather than taken deliberately, such as a misconfigured storage bucket left public.
Under UK GDPR, a personal data breach specifically means a security failure leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. Note that accidental destruction counts: losing data irretrievably is a breach even if nobody else ever saw it.
How breaches actually begin
The realistic list is short and stable year on year. Attackers use what works, and what works is rarely sophisticated.
- Stolen or reused credentials, often from an unrelated site, used where multi-factor authentication is absent.
- Phishing that harvests a password, or increasingly one that captures a session token and bypasses MFA.
- An unpatched internet-facing service: VPN appliance, mail server, file transfer product, remote access exposed directly.
- Misconfiguration: a public storage bucket, an over-permissive share, a test system with production data.
- A supplier or managed service provider compromised first, then used as a trusted route in.
- An insider, occasionally malicious, more often careless with a personal cloud account.
The four stages, and where to interrupt them
Breaches follow a recognisable shape: initial access, movement inside the estate, collection and exfiltration of data, then discovery. Each stage is an opportunity, and the middle ones are where most estates have the least visibility.
Interrupting initial access is prevention: MFA, patching, removing exposed services. Interrupting movement is segmentation and least privilege, so a compromised laptop does not reach the finance server. Interrupting exfiltration means noticing unusual volumes of outbound data. Shortening discovery means logging and actually reading the logs, which is the step most often skipped.
The first hours
The instinct is to clean up. Resist it briefly, because the evidence of how far the intrusion went lives on the affected machines, and reimaging destroys it. Contain first, preserve second, then remediate.
What reduces the damage most
The controls with the best return are unfashionable. Multi-factor authentication on every external service removes the single most common route in. Prompt patching of internet-facing systems removes the second. Least privilege limits how far any single compromise reaches. Tested, offline-capable backups turn a ransomware event from an existential problem into an expensive weekend.
Beyond those, the two things that consistently separate a contained incident from a serious one are logging you can actually search, and a written plan someone has rehearsed. Both are cheap. Neither gets attention until it is needed.
First-hours response
1. Contain without destroying evidence
Isolate affected devices from the network but leave them powered on where you can. Disable compromised accounts and revoke active sessions and tokens.
2. Preserve what you have
Snapshot affected systems, and export logs from identity providers, mail, VPN and endpoint tools before retention windows expire.
3. Establish scope
Which accounts, which systems, which data, and over what period. Assume more than you can prove until the logs say otherwise.
4. Start the notification clock
If personal data is involved in the UK or EU, you have 72 hours from awareness to notify the regulator where the breach is likely to pose a risk. Record when awareness began.
5. Reset credentials in the right order
Privileged and service accounts first, then users. Rotate API keys and shared secrets, which are routinely forgotten.
6. Remediate and record
Close the original route in, rebuild rather than clean where you can, and write down what actually happened while it is still accurate.
Common mistakes
- Reimaging the first affected machine immediately, destroying the evidence needed to scope the incident.
- Resetting user passwords while leaving service accounts and API keys untouched.
- Assuming MFA makes phishing irrelevant. Stolen session tokens bypass it.
- Discovering during the incident that the backups were never test-restored.
Frequently asked questions
- What counts as a data breach?
- Any incident where data you hold is accessed, copied, altered, disclosed or destroyed without authorisation. It includes accidental exposure and irretrievable loss, not only deliberate theft.
- What is the most common cause of a data breach?
- Compromised credentials, usually where multi-factor authentication was not enabled, followed closely by unpatched internet-facing systems and misconfigured storage or shares.
- How long does it take to detect a breach?
- Typically weeks to months. Detection depends on whether anyone is reviewing logs and alerts, which is why shortening that gap is a distinct piece of work from prevention.
- Do I have to report a data breach?
- In the UK and EU, a personal data breach likely to pose a risk to individuals must be reported to the regulator within 72 hours of becoming aware, and affected individuals informed where the risk is high.
- What should I do first in a breach?
- Contain the affected accounts and devices without wiping them, preserve logs and snapshots, then establish scope. Cleaning up before preserving evidence is the most common early mistake.
How this works in 247connect
Remote access is a common route into an estate, which is why 247connect uses a zero-trust model with AES-256 encryption, no inbound ports open, and an audit record of every session, so the access itself does not widen the attack surface.
More IT explainers
What is a botnet?
A botnet is a network of compromised devices under one operator's control, used for DDoS attacks, spam, credential stuffing and crypto mining. How devices get recruited, why infections go unnoticed, and the signs worth watching for.
What is patch management?
Patch management is the process of finding, testing, deploying and verifying updates across an estate. The five-stage cycle, deployment rings, realistic timescales, and why verification is where most patching programmes actually fail.
What is RDP?
RDP is Microsoft's Remote Desktop Protocol, built into Windows for remote sessions. How it works, what it is genuinely good at, why exposing it to the internet is dangerous, and where brokered remote support tools fit instead.