What is a data leak?
Definition
A data leak is when personal or sensitive information ends up somewhere it shouldn't be, such as an open server, a misdirected email or a shared file, often by mistake rather than because someone broke in.
- Category
- Data
- Also called
- data leakage, data leaks
- Last updated
A data leak is an exposure of information to people who were never meant to see it. NIST describes data loss as the exposure of sensitive information through either theft or leakage, which puts leaks on the accidental side of the pair: nobody has to attack anything for a leak to happen.
The UK's data protection regulator, the ICO, lists the kinds of mistakes that count when personal information is involved: it is inappropriately accessed, lost, accidentally destroyed, altered without permission, damaged, or disclosed to someone it shouldn't have been. In plain terms, that covers an email sent to the wrong recipient, a spreadsheet left open to anyone with the link, or a database set up without a password.
Data leak vs. data breach
People use the two words as if they were the same, and in everyday talk they mostly are. The usual distinction is about cause. A breach is typically an attack, where someone gets past a company's defences. A leak is typically a slip, where the company exposes the data itself. For you the result is similar: your details are in the wrong hands, or could be.
Under UK GDPR the legal term is "personal data breach", and the ICO defines it broadly as a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. That wording covers leaks and attacks alike.
Why it matters to you
You rarely get a say in a leak, because it happens on a system you don't control. What leaks is often the stuff that makes scams convincing: your name, email, phone number, address and sometimes passwords. Scammers use that to write messages that sound like they come from a company you really use.
How to protect yourself
- 1
Change the password on the affected account
If a company tells you it leaked your details, change that account's password first. If you reused the password anywhere else, change it there too.
- 2
Turn on two-step verification
A leaked password is much less useful to someone who also needs a code from your phone or an authenticator app.
- 3
Treat unexpected messages with suspicion
After a leak, expect emails and texts that quote your real details. Don't click links in them. Go to the company's site or app yourself.
- 4
Shrink what can be found about you
Leaked data gets combined with what is already listed on people-search sites. Serus finds where your address and phone number are listed and removes them, and alerts you when your data turns up in breach data.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is a data leak the same as a data breach?
Often people use them interchangeably. A leak usually means the data was exposed by mistake, a breach usually means someone attacked the system. The ICO's legal definition of a personal data breach covers both.
What should I do if my data was leaked?
Change the password for the affected account and anywhere you reused it, turn on two-step verification, and watch for messages that use your real details. Only act on messages by going to the company's own site or app.
Can a leaked email address or phone number be taken back?
Once data has been copied, the original company can't pull it back from everyone who has it. That is why changing passwords and being cautious with messages matters more than waiting for the data to disappear.
Sources
Something wrong or out of date? Tell us and we'll re-check it.