A data breach occurs when an attacker gains access to and downloads protected data, often from a database. It is a worst-case incident when data is a key asset: the attacker can take far more than usernames and passwords, including access tokens, chat logs, trade secrets, personally identifiable information, and credit-card numbers. section 1.2
Stolen credentials can be reused against other sites in password-spraying or credential-stuffing attacks. Database write access can also widen the attack: an attacker may add malicious JavaScript that a website renders or insert malicious files that users download. section 1.2
A breach can trigger required disclosure to customers and reputational damage. Treat it as a loss of users’ trust, not only a technical failure. Clearly identify what data, content, or functionality an attacker may have accessed and whether credentials could be at risk. section 1.2 section 15.5
A user-facing breach announcement should:
- Give a precise timeline and relevant technical details. section 15.5
- Explain the concrete steps being taken to prevent recurrence. section 15.5
- State the action expected from users, such as a forced password rotation when credentials may have been stolen. section 15.5
Transparency matters even where disclosure laws do not require it. A clear explanation of the incident, its user impact, and the organization’s response gives affected people the information needed to act. section 15.5
