What’s the Difference Between a Data Leak and a Data Breach?

What’s the difference between a data leak and a data breach? I think this is both a great question and an important distinction to understand in today’s climate, where instances of both are regularly making national headlines.

Here’s how I look at it: In a data breach, a bad actor (e.g., a hacker or malicious insider) takes some sort of action to access sensitive data. Many scenarios fit the bill here, from a widespread breach at a major retailer that results in millions of credit card numbers being obtained to a breach where foreign state-sponsored hackers steal terabytes of data. Basically, a breach involves nefarious intent and generally results in some kind of monetary, political, reputational, or nation-state gain.

A data leak is a different story. For example, a company’s website could lack the proper (and basic) access controls to restrict users from accessing someone else’s information. Thus, any user (nefarious, curious, or accidental) could type in a different record number in the browser and gain full access to that record. Here’s the problem in this example: We really don’t know if the data made available in the leak was accessed or used in a nefarious manner. Certain hacker groups may have been utilizing it for years, or it may have never actually been misused. Because of this lack of clarity, we have to proceed as if it has been used—or could be used in the future—in compromising ways.

So what’s worse: A data leak or a data breach? In one scenario, nefarious-minded individuals are taking action to access sensitive data, and in the other, organizations are leaving it wide open for the taking, whether accidental or purposeful. It’s sort of like if you were to buy a new 84” big-screen TV for the Super Bowl only to either have someone break into your home and steal it or walk up and grab it because you left it sitting unprotected in your driveway for a week. In the first scenario, you’re likely angry that someone broke into your home and you wish you had better home protection. In the second, you’re probably more angry at yourself than anything for leaving it out in the open for an extended period of time.

In either case, incidents like these—whether a breach or leak—make headline news. Companies of all sizes and within all industries are constantly challenged to protect the confidentiality, integrity, and availability of sensitive data, so it’s important that you be able to understand the difference between a data breach and a data leak when dealing with a challenge or referencing a current event.