Data Breach

A security incident in which personal information and confidential data held by an organization are accessed, leaked, or exposed without authorization, simultaneously causing technical, legal, and tru

Data Breach

Overview

A data breach refers to a security incident in which data such as personal information, financial information, trade secrets, and authentication credentials held by an organization or individual is accessed, copied, or disclosed to unauthorized parties through hacking, insider activity, misconfiguration, physical theft, and similar means. It is treated not merely as a hacking incident but as a management risk that directly affects corporate trust, regulatory compliance, stock price, and user safety. GDPR, CCPA, and Korea's Personal Information Protection Act (개인정보 보호법) stipulate that leaks meeting certain conditions must be reported, making data breaches both a technical issue and a legal and reputational issue.

Main Content

Definition and Scope

Data breaches center on the breach of confidentiality, but they are often accompanied by breaches of integrity (data tampering/ransomware) and availability (service disruption). More important than the scale of leaked data is the sensitivity and re-identifiability of the data. Data that appears to be merely a list of email addresses can become material for account takeover or phishing attacks when combined with other leaked information.

Major Types

  • External attack type: phishing, credential theft, vulnerability exploitation, supply chain attacks, zero-day exploitation
  • Insider threat type: departing employees taking data, abuse of privileges, accidental external sharing
  • Misconfiguration type: exposure of public cloud storage (S3 buckets, etc.), incorrect access controls
  • Physical leak type: loss and theft of laptops, USB drives, and documents
  • Third-party type: cascading leaks due to breaches at partners or SaaS vendors

Attack Chain

A typical flow is reconnaissance → initial intrusion (phishing/vulnerabilities) → privilege escalation → lateral movement → data collection and exfiltration → extortion/sale. Recently, attackers do not stop at exfiltration alone but combine it with ransomware, leading to "double extortion," and data is sometimes sold in parts on dark web markets and Telegram channels.

Impact and Damage

  • Individuals: account takeover, financial fraud, surge in spam/phishing, identity theft
  • Companies: fines/lawsuits, recovery costs, customer churn, stock price decline, executive accountability
  • Society: when large-scale credentials leak, multiple services suffer cascading damage through "credential stuffing"

According to the annual IBM and Ponemon report, the global average cost of a breach is counted in the millions of dollars, and the longer it takes to detect and contain, the more the cost surges.

Detection and Response

The standard response procedure follows NIST and the guides of regulatory agencies in each country.

1. Detection/Verification: determine scope through SIEM, EDR, DLP, and anomaly behavior analysis

2. Containment: block exfiltration paths, invalidate accounts/keys, isolate compromised hosts

3. Eradication/Recovery: patch vulnerabilities, verify backups, restore normal services

4. Reporting/Notification: notify regulators and data subjects within legal deadlines

5. Post-incident Improvement: forensic report, recurrence prevention measures, strengthened monitoring

Legal Regulation

GDPR requires notification within 72 hours and notification of data subjects in high-risk cases, and can impose fines of up to 4% of global revenue or EUR 20 million for violations. In the United States, state laws and sector-specific regulations (HIPAA, GLBA) coexist, while Korea operates leak notification/reporting obligations and a fine system under the Personal Information Protection Act. Since 2024, regulations for the supply chain and financial sector, such as the EU's NIS2 and DORA, have been strengthened.

Prevention Principles

Zero trust, least privilege, multi-factor authentication (MFA), encryption (at rest and in transit), key management, secrets management, regular penetration testing, employee security training, and third-party security assessment are the basic pillars. In addition, the principle of data minimization is emphasized as an approach that reduces the scale of damage in the event of a breach itself.

Latest Trends

  • Concentrated supply chain attacks: increasing cases where many client companies are simultaneously affected by breaches at SaaS or identity providers
  • Credential-centric attacks: spread of infostealer malware targeting password reuse and session token theft
  • Stronger regulation and expanded responsibility: shorter reporting deadlines, personal responsibility for CISOs, increase in class action lawsuits
  • The double-edged nature of AI: while AI helps automate anomaly detection and response, it refines social engineering attacks through phishing sentence generation, vulnerability analysis, and deepfakes
  • Post-quantum cryptography (PQC) discussion: establishing transition plans to prepare for the "Harvest Now, Decrypt Later" threat
  • Data sovereignty and cross-border transfers: increasing compliance complexity for global companies due to differing regulations across countries

Related Topics

  • [[Ransomware]]
  • [[Zero Trust]]
  • [[Personal Information Protection Act]]
  • [[Phishing]]
  • [[Cybersecurity]]
  • [[GDPR]]