A corporate intrusion can become a privacy incident fast when personal data is copied out of internal systems, forcing containment, investigation, and legal triage at the same time.