What is a data breach?

A data breach is a security incident in which information is exposed, lost or accessed without permission, through an attack or a mistake. If your details are involved, criminals may use them in convincing messages. A personal data breach also creates responsibilities for the organisation holding that information. 12

By Secordit. Last checked: 7 November 2026.

Go to the steps · All glossary terms

How it works

  1. Information is accessed, disclosed, lost or otherwise affected by a security incident. 12
  2. The organisation investigates what happened and who may be affected. 12
  3. Exposed details can be used in follow-up impersonation or phishing attempts. 12

Real UK example

The ICO's June 2025 findings on 23andMe describe UK residents’ personal information being accessed after a credential-stuffing attack. The information involved varied between accounts.

This was not simply a list of passwords: the findings describe personal and family information. Customers were not responsible for the company’s security obligations. 3

Warning signs

  • The organisation confirms a breach through its genuine channels. 124
  • You receive unusual messages referring to details the organisation held. 124
  • Account settings or activity change without your permission. 124
  • A message about compensation or a password reset pressures you to use its link. 125634

What to do now

  1. As a customer, check the organisation’s genuine website for instructions. 124
  2. Change exposed or reused passwords. Watch for follow-up messages. 125634
  3. As a business, assess the risk to people and use the ICO’s breach guidance. Not every breach must be notified. 124

UK reporting and support

  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 789
  • For fraud or hacking in England, Wales or Northern Ireland, use Report Fraud. In Scotland, call Police Scotland on 101. 810
  • For a business under a live cyber attack in England, Wales or Northern Ireland, Report Fraud also gives telephone support: 0300 123 2040. 118
  • If someone is in danger, call 999. 10

How to protect yourself

  • Keep unique passwords and turn on two-step verification. 125634
  • At work, restrict access to personal information and check recipients before sharing it. 124
  • Prepare an incident contact list and know who assesses breach reporting. 124

Frequently asked questions

Does every data breach mean my password was stolen?

No. The information affected depends on the incident. Ask the organisation what happened and which details were involved. 2

Must every business data breach be reported to the ICO?

No. Assess the risk to people. The ICO says a likely risk requires notification without undue delay, where feasible within 72 hours of becoming aware. 41

Can a breach lead to scam calls and emails?

Yes. The NCSC warns that criminals can use exposed details to make follow-up messages or calls more convincing. 2

Read the longer guide

Matching kit

First Hour After a Breach · £29 · Digital download.

An incident-response planning kit for UK small businesses. It is not a live incident-response or legal service.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. ICO, Personal data breaches: a guide | ICO. Accessed 7 November 2026 (Europe/London).
  2. NCSC, Data breach guidance for individuals. Accessed 7 November 2026 (Europe/London).
  3. ICO, 23andMe fined £2.31 million for failing to protect UK users’ genetic data | ICO. Accessed 7 November 2026 (Europe/London).
  4. ICO, UK GDPR data breach reporting (DPA 2018) | ICO. Accessed 7 November 2026 (Europe/London).
  5. NCSC, Recovering a hacked account | National Cyber Security Centre. Accessed 7 November 2026 (Europe/London).
  6. NCSC, Top tips for staying secure online | Turn on 2-step verification (2SV) | National Cyber Security Centre. Accessed 7 November 2026 (Europe/London).
  7. UK Finance, Authorised Push Payment Fraud Reimbursement | UK Finance. Accessed 7 November 2026 (Europe/London).
  8. Report Fraud, Report Fraud alert: Police forces being impersonated in scam calls using ‘spoofed’ phone numbers - Report Fraud. Accessed 7 November 2026 (Europe/London).
  9. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 7 November 2026 (Europe/London).
  10. Police Scotland, How to report a crime - Police Scotland. Accessed 7 November 2026 (Europe/London).
  11. Report Fraud, Guide to reporting cyber crime & fraud - Report Fraud. Accessed 7 November 2026 (Europe/London).