ไทย
English
A data breach is one of the most significant risks every organization must be prepared to address. Its consequences extend far beyond IT systems and may include financial losses, reputational damage, loss of customer trust, and legal liability under personal data protection laws.
In this article, BMSP explains what a data breach is, how it occurs, its most common causes and impacts, and the steps organizations can take to prevent and reduce the risk of data exposure.
Table of Contents
What is a Data Breach?
A data breach is a security incident in which an organization’s sensitive information or personal data is accessed, disclosed, stolen, altered, destroyed, lost, or used without authorization.
Although the term is commonly associated with data leaks, a data breach does not only refer to incidents in which hackers steal information. It may also include situations such as:
- Sending an email containing customer information to the wrong recipient
- Losing a device that contains sensitive data
- Configuring a database or cloud storage service so that it is publicly accessible
- Allowing an employee to remove information from the organization without authorization
- Having data encrypted and stolen by malware or ransomware
- Having data altered or deleted until it can no longer be used
A data breach may result from a cyberattack, employee error, insecure system configuration, or vulnerabilities involving external service providers and business partners.
The General Data Protection Regulation, or GDPR, defines a personal data breach as a security breach that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.
Similarly, NIST states that a data breach may involve the unauthorized extraction, leakage, or disclosure of information to individuals who do not have permission to access it, including disclosure to the public.
How Does a Data Breach Occur?
A data breach often begins when an attacker identifies a weakness that can be used to gain access to a system. Common entry points include software vulnerabilities, compromised credentials, and social engineering attacks conducted through email or telephone calls.
Once access has been obtained, the attacker may escalate privileges, search for sensitive databases, move laterally to other systems, and transfer information to an external location.
However, not every data breach is caused by a direct cyberattack. Some incidents result from mistakes such as assigning inappropriate access permissions, sending information to the wrong recipient, or uploading corporate files to unauthorized cloud services or artificial intelligence tools.
According to the Verizon Data Breach Investigations Report 2026, among data breaches with a known initial access vector, excluding incidents involving errors or privilege misuse, vulnerability exploitation was the most common method of entry, accounting for 31% of incidents. Credential abuse accounted for 13%.
The report also found that the human element was involved in 62% of data breaches. Incidents involving third-party service providers increased by 60% compared with the previous year’s dataset and accounted for 48% of all analyzed data breaches.
Common Causes of Data Breaches
Unpatched Software and System Vulnerabilities
Attackers can exploit vulnerabilities in operating systems, applications, VPNs, firewalls, web applications, and network devices to gain unauthorized access.
Delays in applying security patches make it easier for attackers to exploit vulnerabilities for which attack techniques or proof-of-concept code have already been publicly disclosed.
The Verizon DBIR 2026 reported that vulnerability exploitation had increased to become the leading initial access vector. Organizations in the report’s dataset took a median of approximately 43 days to fully remediate vulnerabilities.
Stolen Passwords and User Accounts
Leaked credentials may be used to access an organization’s email, VPN, cloud services, or other business systems.
Implementing identity security measures alongside multi-factor authentication and abnormal behavior detection can therefore play an important role in reducing the risk of account takeover and data breaches.
The risk is significantly higher when an organization does not use multi-factor authentication, continues to permit weak or easily guessed passwords, or lacks the ability to detect unusual login activity.
Phishing and Social Engineering
Attackers may impersonate executives, IT personnel, banks, business partners, or service providers to persuade employees to click malicious links, open attachments, disclose passwords, approve login requests, or transfer money.
Social engineering is not limited to email. It can also take place through telephone calls, SMS messages, chat applications, and video calls.
The Verizon DBIR 2026 found that phishing remained an important initial access method. The reported data also showed that attacks conducted through mobile-focused communication channels had higher successful response rates than simulated email-based attacks.
System Misconfiguration
A misconfigured system may allow attackers to discover and download information without using malware or carrying out a sophisticated intrusion.
Common examples include:
- Exposing a database directly to the internet
- Configuring cloud storage as publicly accessible
- Granting users more permissions than they require
- Storing API keys or passwords in source code
- Leaving unnecessary ports or services open
- Failing to separate critical systems from the general corporate network
Malware and Ransomware Steal Information
Malware is malicious software designed to steal information, monitor user activity, create unauthorized access to systems, or damage devices and networks.
Common examples include infostealers, Trojans, spyware, and ransomware.
Ransomware is one of the most significant forms of malware associated with data breaches. Attackers may steal information before encrypting files and then threaten to publish or sell the stolen data as leverage in extortion negotiations.
The Verizon DBIR 2026 reported that ransomware was involved in approximately 48% of the data breaches in its dataset, representing an increase from the previous year.
Human Error Causes Data Exposure
Data breaches may result from unintentional mistakes, such as sending a file to the wrong person, storing corporate information on a personal device, uploading information to an unauthorized service, or assigning inappropriate access permissions.
Intentional actions by employees or other insiders, such as stealing, deleting, or selling information, are generally categorized separately as insider threats.
Data is Exposed Through External Service Providers and Business Partners
Even when an organization has strong internal security measures, its information may still be exposed through cloud providers, outsourcing companies, software developers, or business partners that have access to its data or systems.
This risk is particularly relevant to supply chain attacks, in which an attacker exploits a vulnerability affecting a vendor, partner, or software provider and uses that trusted relationship as a pathway into the organization.
Devices are Lost or Stolen
Laptops, mobile phones, external hard drives, and USB drives that are not encrypted may expose the information stored on them if they are lost or stolen.
Types of Information Commonly Exposed in Data Breaches
The type of information targeted or exposed varies according to the organization’s industry, business operations, and technology environment.
Information commonly involved in data breaches includes:
- Personally identifiable information: Names, surnames, national identification numbers, dates of birth, addresses, telephone numbers, email addresses, photographs, and passport numbers
- User account information: Usernames, passwords, password hashes, session tokens, API keys, private keys, and answers to security questions
- Financial information: Credit card numbers, bank account numbers, transaction histories, income information, and payment details
- Health information: Medical histories, test results, pre-existing conditions, health insurance information, and patient records
- Employee and customer information: Employment histories, salaries, employment contracts, contact details, purchase histories, and service usage information
- Business information: Business plans, customer lists, quotations, contracts, financial reports, project documents, and research information
- Intellectual property: Source code, product designs, manufacturing formulas, patents, algorithms, and technical documentation
- System information and technical secrets: Network diagrams, configurations, logs, certificates, encryption keys, and administrator account credentials
NIST notes that incidents involving personally identifiable information may cause harm and inconvenience and may lead to identity theft or the fraudulent use of personal information.
Organizations should therefore classify information according to its sensitivity, limit access to individuals who require it, and implement appropriate safeguards.
These measures may include data encryption, access logging and monitoring, secure backups, and policies governing how long information is retained and how it is securely destroyed. Together, these controls can reduce both the likelihood and potential impact of a data breach.
Examples of Major Data Breaches
Equifax Data Breach
In 2017, credit reporting company Equifax disclosed a data breach that affected approximately 147 million people.
The compromised information included names, dates of birth, Social Security numbers, and some payment card information.
The United States Federal Trade Commission stated that the incident involved the company’s failure to implement adequate basic security measures. A settlement was subsequently established to provide up to approximately USD 425 million in assistance to affected individuals.
Marriott and Starwood Data Breaches
Marriott and Starwood experienced multiple data breaches affecting hundreds of millions of customers.
The information involved included passport details, payment card numbers, membership numbers, dates of birth, email addresses, and other personal information.
The FTC stated that failures in the companies’ security practices had contributed to several large-scale data breaches. Its final order required the companies to implement a comprehensive information security program.
Taken together, the incidents reviewed by the FTC affected more than 344 million customers worldwide.
MOVEit Transfer Data Breach
In 2023, the CL0P group exploited a zero-day SQL injection vulnerability, identified as CVE-2023-34362, in MOVEit Transfer software.
The attackers used the vulnerability to install a web shell and steal information from the system’s database.
The incident affected numerous organizations using the software, including organizations indirectly exposed through third-party service providers.
The Cybersecurity and Infrastructure Security Agency and the Federal Bureau of Investigation subsequently published indicators of compromise and recommended mitigation measures relating to the incident.
The Impact of a Data Breach on an Organization
Financial Losses
An organization may incur expenses related to incident investigation, system recovery, external specialists, notifications to affected individuals, legal proceedings, customer compensation, and improvements to security controls.
The IBM Cost of a Data Breach Report 2025 estimated that the global average cost of a data breach was approximately USD 4.44 million per incident.
Actual costs vary according to the country, industry, amount and type of affected information, and the time required to detect and contain the incident.
Business Disruption
Systems may need to be shut down so that the organization can investigate or contain an incident.
As a result, employees may be unable to work, customers may be unable to use services, production processes may be interrupted, and the organization may lose revenue while systems are being restored.
Loss of Trust and Reputation
Customers, business partners, and investors may lose confidence in an organization’s ability to protect information.
The reputational impact may be particularly severe when an organization delays its notification, communicates unclearly, or experiences repeated incidents.
Legal and Regulatory Risk
When personal information is exposed, an organization may be required to notify regulators and affected individuals. It may also face regulatory investigations, legal action, or claims for compensation.
In Thailand, Section 37 of the Personal Data Protection Act requires a data controller to notify the Office of the Personal Data Protection Committee of a personal data breach without delay and, where feasible, within 72 hours of becoming aware of it.
An exception may apply when the incident is unlikely to result in a risk to the rights and freedoms of individuals. Where the breach is likely to result in a high risk, the affected data subjects must also be notified without delay, together with appropriate remedialmeasures.
Impact on Data Subjects
Exposed information may be used for identity theft, fraudulent account creation, financial scams, online account takeover, targeted phishing, or public disclosure intended to harm an individual.
Loss of Competitive Advantage
Product information, business plans, source code, customer lists, and pricing information may be transferred to competitors or sold on underground markets.
The exposure of this information can weaken an organization’s competitive position over the long term.
How Should an Organization Respond to a Data Breach?
When signs of a data breach are detected, the organization should activate its incident response process.
6 Key Steps for Handling Cybersecurity Incidents: A Comprehensive Guide
Operational teams should also understand what they should and should not do immediately after discovering a cyber incident. Incorrect actions may destroy valuable evidence or allow the incident to expand.
1. Activate the Incident Response Plan
Assemble all relevant stakeholders, including representatives from security, IT, legal, data protection, risk management, communications, and executive management.
Responsibilities, decision-making authority, and communication channels should be clearly defined.
2. Investigate and Confirm the Incident
Collect and examine logs, alerts, network traffic, endpoint evidence, and cloud data to determine:
- Whether an incident has actually occurred
- When the incident began
- Which systems have been affected
- Whether the attacker remains active within the environment
NIST recommends that incident response teams verify the incident, collect and analyze evidence, prioritize actions, limit damage, identify the root cause, and restore business operations.
3. Contain the Incident
Containment actions should preserve evidence and avoid unnecessarily alerting the attacker before the organization understands the full scope of the incident.
Possible actions include:
- Isolating malware-infected devices from the network
- Suspending compromised user accounts
- Changing passwords and revoking session tokens
- Closing exploited vulnerabilities or services
- Blocking malicious IP addresses, domains, or files
- Restricting access to databases and critical systems
4. Assess the Scope and Impact
The organization should determine:
- What types of information were affected
- How many records were involved
- Which individuals were affected
- Whether the information was viewed, downloaded, altered, or deleted
- Whether the information was encrypted or otherwise protected
- How likely the information is to be used to cause harm
5. Notify Regulators and Affected Individuals
When personal information is involved, the organization must assess its obligations under the PDPA and other applicable laws.
In Thailand, data controllers should prepare the information required to notify the regulator within the 72-hour timeframe where the legal conditions apply.
Affected individuals must also be notified without delay when the incident is likely to result in a high risk to their rights and freedoms.
6. Eliminate the Cause and Restore Systems
After the incident has been contained, the organization should remove malware, close vulnerabilities, investigate persistence mechanisms, rotate affected credentials, and restore systems from trusted backups.
Before returning systems to normal operation, the organization should verify that no remaining access path would allow the attacker to re-enter the environment.
7. Communicate Transparently
Communications should be accurate, consistent, and carefully prepared so that they do not introduce additional risks.
The organization should explain:
- What information was affected
- What actions the organization has taken
- What affected individuals should do to protect themselves
8. Conduct a Post-Incident Review
A root cause analysis and lessons-learned review should be conducted to identify weaknesses in people, processes, and technology.
The organization should then update its incident response plan and related controls based on the findings.
How to Prevent and Reduce the Risk of Data Breaches
Create a Data Inventory and Classification Framework
Organizations should understand what information they hold, where it is stored, who can access it, and how long it needs to be retained.
Sensitive information should be classified according to categories such as:
- Public
- Internal
- Confidential
- Restricted
Retain Only Necessary Information
Reducing the amount of stored information can reduce the potential impact of a breach.
Information that is no longer required should be securely deleted, destroyed, or anonymized in accordance with the organization’s data retention policy.
Use Multi-Factor Authentication
Multi-factor authentication should be enabled for email, VPNs, cloud services, administrator accounts, and systems containing sensitive information.
For high-risk accounts, organizations should consider phishing-resistant authentication methods such as hardware security keys or passkeys.
Apply the Principle of Least Privilege
Users should receive only the permissions required to perform their responsibilities.
Administrator accounts should be separated from standard user accounts, and access rights should be reviewed regularly, particularly when employees change roles or leave the organization.
Manage Vulnerabilities and Security Patches
Organizations should maintain an asset inventory, conduct vulnerability scanning, and establish a patch management process with remediation service-level agreements based on severity.
Vulnerabilities that are actively exploited or listed in the CISA Known Exploited Vulnerabilities Catalog should receive the highest priority.
The Verizon DBIR 2026 identified vulnerability exploitation as the most common initial access method in data breaches. Organizations should therefore focus on reducing the time between public vulnerability disclosure and system remediation.
Encrypt Sensitive Information
Sensitive information should be encrypted both at rest and in transit.
Encryption keys should be stored separately from the information they protect. Appropriate encryption can reduce the severity of an incident when an attacker is unable to obtain the corresponding key.
Continuously Monitor and Detect Threats
Organizations should consider using technologies such as:
- Endpoint Detection and Response
- Security Information and Event Management
- Data Loss Prevention
- Identity monitoring and detection systems
However, deploying security tools alone may not be sufficient.
Many organizations operate SIEM platforms but are still unable to determine what happened during an incident because they lack the necessary logs, contextual information, detection use cases, or a clearly defined incident response process.
Protect Email and Train Employees
Organizations should implement email security, URL filtering, attachment analysis, and phishing simulations.
Employees should also have an accessible and straightforward channel through which they can report suspicious emails or security incidents.
Manage Third-Party Risk
Before allowing a vendor to access systems or information, the organization should assess the vendor’s security controls.
Contracts should define incident notification requirements, and access should be limited according to business needs.
Third-party risk should be monitored throughout the duration of the commercial relationship.
Maintain Secure Backups
Backups should be separated from production systems, protected against unauthorized modification, and regularly tested to confirm that information can be successfully restored.
Backups can help restore business operations, but they cannot eliminate the consequences of information that has already been stolen.
Prepare an Incident Response Plan
Organizations should clearly define:
- Roles and responsibilities
- Escalation procedures
- Contact channels
- Evidence preservation procedures
- PDPC notification processes
- Communication templates for customers and other stakeholders
The plan should be tested regularly through tabletop exercises.
NIST recommends that organizations prepare to detect, respond to, and recover from incidents affecting data confidentiality. Incident management should also be integrated into the organization’s broader risk management processes.
Use External Cybersecurity Expertise
Organizations with limited cybersecurity personnel or resources may use a Managed Service Provider or Managed Security Service Provider to help manage IT systems, monitor threats, and continuously reduce the risk of data breaches.
Working with experienced specialists who use regularly updated tools can help organizations detect risks and respond to incidents more quickly.
It can also reduce the workload of internal teams and help ensure that security measures remain aligned with a constantly changing threat landscape.
Key Takeaways
A data breach occurs when information is accessed, disclosed, lost, altered, or destroyed without authorization.
It may result from cyberattacks, software vulnerabilities, compromised credentials, human error, or security weaknesses involving external service providers.
When an incident occurs, the organization must quickly investigate and contain it, preserve evidence, assess the affected information and individuals, comply with notification obligations, and restore systems securely.
Reducing data breach risk requires continuous action across people, processes, and technology.
This includes managing information, controlling access, updating systems, detecting threats, managing third-party risk, and maintaining an incident response plan that can be effectively used during a real incident.
How BMSP Can Help
As a leader in end-to-end MSP and MSSP services in Thailand, BMSP helps organizations manage their IT infrastructure, assess and remediate vulnerabilities, implement and update security solutions, investigate suspicious activities, and continuously monitor cyber threats through a team of experienced specialists.
BMSP can also support organizations in preparing for and responding to data breaches through a broad range of cybersecurity solutions, including:
- Endpoint Security: EDR and XDR solutions that protect against malware and ransomware and detect abnormal behavior on endpoint devices
- Identity and Access Security: MFA, IAM, PAM, ITDR, and Zero Trust solutions that control access and prevent the unauthorized use of user accounts
- Data and Email Security: DLP and email security solutions that help prevent data leakage, phishing, and email-borne threats
- Network, Application, and Cloud Security: WAF, API security, DDoS protection, CNAPP, and micro-segmentation
- Vulnerability Management: Vulnerability assessments, patch management, and continuous remediation tracking
- CSOC as a Service: Continuous 24/7 threat monitoring using SIEM, UEBA, SOAR, threat intelligence, and threat hunting
- Incident Response: Investigation, containment, threat eradication, and system recovery, supported by an Incident Response Retainer service
- External and Third-Party Risk: Attack Surface Management, dark web monitoring, and supply chain risk management
BMSP also provides additional cybersecurity and IT security solutions that can work together to strengthen threat prevention, detection, and response capabilities.
Each solution can be designed to suit the organization’s infrastructure, risk profile, budget, and specific operational requirements.
Organizations seeking to assess their risks, strengthen their security environment, or identify suitable cybersecurity solutions can contact the BMSP specialist team for consultation and further information.
