A personal data breach is a security incident that leads to accidental or unlawful access, disclosure, loss, alteration, or destruction of personal data. The data may be exposed through a hacked system, a misdirected file, weak access controls, accidental deletion, or malware that encrypts or steals records. In privacy law, the term is broader than “hack”: it covers any event that can harm the confidentiality, integrity, or availability of personal information.
In cyber security, the term matters because it triggers response obligations and risk analysis. Defenders need to identify what data was affected, whether attackers could actually read or change it, and whether the breach may enable fraud, identity theft, or account takeover. Common defenses include encryption, strong authentication, least-privilege access, secure backups, logging, and rapid incident notification. Good breach handling also means preserving evidence, resetting exposed credentials, and informing affected people quickly enough to limit secondary abuse.