A data breach occurs when a cybersecurity incident results in compromise, unauthorized access, or theft of data, systems, or networks. Not every unusual event is a breach: an event warrants investigation, while an incident violates security policy. Confirming a breach helps determine the urgency and scope of the response. section 1.5.3
Breach management combines preparation with action. Security controls and monitoring aim to prevent or detect compromise; containment, investigation, remediation, and review limit damage and support recovery. The incident response plan should also protect business continuity and guide communication. section 9.1
Tracing a customer-data breach
A financial institution detected unusual traffic from an internal server and found that customer data had been sent to an external IP address. Investigators correlated access logs, firewall logs, network traffic, and alerts to reconstruct the sequence: a phishing email compromised an employee’s credentials, unauthorized logins followed, and data was exfiltrated. More than 10,000 customers’ personal information was affected. The institution responded with multifactor authentication for remote access, stronger email filtering, staff training, and improved monitoring. section 9.5.1
A tabletop exercise can test decisions before a real breach. Start with suspicious traffic from a server holding customer information and ask how the team will confirm and contain unauthorized access. Then introduce encrypted customer data and a journalist’s inquiry. Rehearse who makes containment decisions, how legal and communications staff participate, and what can be said to customers and the public. section 9.3.1
