Information leakage is the unintended disclosure of sensitive data through speech, devices, documents, metadata, or weak controls. Unlike a direct breach, leakage can happen without breaking into a system: a conversation heard by the wrong person, a recorder left in a meeting room, an exposed log file, or an unprotected screen can all reveal valuable details. In cyber security, leaked information often becomes the starting point for phishing, social engineering, credential theft, or targeted intrusion.
Leakage matters because attackers do not need full access to exploit it. Small clues can expose project names, security procedures, authentication details, or business plans. Defenders reduce this risk by limiting who can access sensitive spaces, banning unauthorized recording devices, using clean-desk and screen-lock policies, reviewing logs and sharing settings, and classifying information so the right controls are applied. Good security programs treat physical rooms, people, and devices as part of the attack surface, not just networks and servers.