A data breach is unauthorized access to, disclosure of, or acquisition of protected information. Breaches can begin with phishing, stolen credentials, vulnerable systems, insiders, or third parties.
Key takeaways
What to know before you act
- A data breach is unauthorized access to or disclosure of protected information; not every security incident is a breach, but each should be assessed.
- Breaches often begin with phishing, stolen credentials, unpatched systems, misconfigured cloud sharing, or a vendor.
- Notification duties depend on the data, the people affected, and applicable laws and contracts, so involve qualified counsel early.
Why it matters
What business leaders should understand
The operational, legal, financial, and reputational impact depends on what data was involved and how quickly the organization can investigate, contain, and communicate.
The right response should reflect your environment, data, vendors, risk, and operational priorities. Use this guide as a practical starting point, then validate important decisions with the people responsible for your technology, cybersecurity, legal obligations, and insurance coverage.
Learn how Meta IT Pro can help with backup and disaster recovery, business continuity planning, and incident response services.
Related reading: Incident response and remediation guide and What is data security?.
How breaches commonly happen
Attackers usually look for the easiest path to valuable information. In small and midsize organizations, that often means an email account, a cloud file share, or a remote-access service. Not all breaches are malicious: misdirected email, lost devices, and misconfigured sharing links can also expose data.
- Compromised email accounts used to read or forward sensitive messages.
- Stolen or reused passwords on cloud applications.
- Unpatched internet-facing systems.
- Public or overly broad sharing links.
- Lost or stolen unencrypted devices.
- Incidents at vendors who hold your data.
What to do if you suspect a breach
Act quickly but carefully. Contain the immediate problem—disable compromised accounts, revoke sessions, and stop unauthorized sharing—while preserving logs and other evidence. Engage your IT or security provider, cyber insurer, and legal counsel early.
Determine what information was involved, whose it was, and whether it was actually accessed or acquired. Those facts drive decisions about notifying affected individuals, regulators, business partners, and law enforcement under applicable state and federal laws and contracts.
- Do not delete evidence or wipe devices before scope is understood.
- Document decisions and actions with timestamps.
- Prepare clear, accurate communication for affected people.
Practical action plan
Steps your business can take
Maintain an incident-response plan with legal, insurance, technical, and leadership contacts.
Use MFA, least privilege, monitoring, patching, encryption, and employee training.
Know where sensitive data is stored and how long it is retained.
Preserve evidence, contain carefully, and obtain appropriate legal guidance after an incident.
Recommended next steps
Continue from this article.
These pages expand the specific risks and decisions covered in this guide. Use them to move from general understanding to the service, tool, or related topic that best matches your next question.
Related guide
Incident response and remediation guide
Prepare roles, evidence handling, containment, and recovery before a breach.
Explore nextRelated guide
What is data security?
Locate sensitive data and apply access, encryption, monitoring, and backup controls.
Explore nextPlanning tool
Cyber-insurance readiness
Review safeguards and evidence insurers commonly request before coverage or renewal.
Explore nextRelated guide
How to check whether your data was breached
Verify breach notices safely and protect accounts after an exposure.
Explore nextWarning signs
Do not ignore these indicators
- Unfamiliar account logins, forwarding rules, or data exports
- Security tools are disabled or logs have been cleared
- Customers receive messages the organization did not send
Frequently asked questions
Common questions, answered.
What counts as a data breach?
Unauthorized access to or disclosure of protected information, whether caused by an attacker, a lost device, or a mistake such as a misdirected email.
What should we do first if we suspect a breach?
Contain the problem, preserve evidence, and contact your IT or security provider, cyber insurer, and legal counsel before making notification decisions.
Do we have to notify customers after a breach?
It depends on the data involved, the people affected, and applicable state, federal, and contractual requirements. Qualified counsel should guide that decision.
How Meta IT Pro can help
Related services and practical next steps
Explore the services connected to this topic. These links provide more detail about scope, safeguards, support, and how to start a conversation with our team.
Authoritative references
Sources and further reading
These primary sources support the guidance in this article and provide additional technical or consumer information.
Federal Trade Commission
Data Breach Response: A Guide for Business
Steps for securing operations, fixing vulnerabilities, and notifying appropriate parties after a breach.
National Institute of Standards and Technology
NIST SP 800-61 Rev. 3: Incident Response Recommendations
Current NIST guidance for integrating incident response into cybersecurity risk management.
Federal Trade Commission
Protecting Personal Information: A Guide for Business
Five principles for taking stock of, reducing, locking down, disposing of, and planning around personal information.
Need help with your IT solution?
Get practical guidance from a local IT and cybersecurity team.
Meta IT Pro helps Massachusetts and Rhode Island businesses improve support, security, Microsoft 365, Google Workspace, networks, backup, recovery, and compliance readiness. Tell us what is not working - or what you want to improve - and we will help identify a sensible next step.