What is data leakage?
Definition
Data leakage is when personal or confidential information reaches people who shouldn't see it, by accident or through weak security, rather than through a deliberate attack on the system holding it.
- Category
- Data
- Also called
- data leak, information leakage
- Last updated
Data leakage means information ends up somewhere it shouldn't be. The cause is often ordinary: an email sent to the wrong person, a spreadsheet shared with the wrong permissions, or bulk emails that show every recipient's address because nobody used BCC. The UK's data regulator, the ICO, lists exactly these as examples of accidental personal data breaches.
The ICO describes a personal data breach more broadly as a security incident that affects the confidentiality, integrity or availability of personal data. A leak is the confidentiality part: someone unauthorised gets to see it.
Leakage vs. a hack
A hack is an attacker breaking in. A leak doesn't need one. The data walks out through a mistake, a misconfigured setting or an insider. The result for you can look the same, though: your name, email or address in the wrong hands. Many people use "leak" and "breach" interchangeably. Our entry on data leaks covers the everyday meaning.
Data leakage vs. data loss prevention
Companies use data loss prevention (DLP) tools to catch leaks. NIST describes DLP as the ability to identify, monitor and protect data in use, in motion and at rest. That's something an organisation sets up. As an individual, you can't install it for the data a company holds about you.
Why it matters to you
Leaked details feed phishing and scams, because a message that knows your name and your account looks real. Once data is out, you can't pull it back, so the useful move is to limit what's connected to you and watch for misuse.
How to protect yourself
- 1
Check whether your email appears in a known breach
Search your address on Have I Been Pwned. If it appears, change the password for that service and anywhere you reused it.
- 2
Use a unique password and two-step verification
A leaked password only opens one door if you never reuse it. A password manager makes that practical.
- 3
Be careful with messages that know your details
If a call or message uses your name or an account detail to sound legitimate, contact the company yourself through its official site.
- 4
Share less in the first place
Give companies only the details they need, and use an email alias for sign-ups you don't trust.
- 5
Cut down the places your data is listed
Serus monitors the dark web and breach databases for your data and alerts you if it appears, and removes your details from data brokers and people-search sites where it can be taken down.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is data leakage the same as a data breach?
They overlap. A breach is the broader term for a security incident affecting personal data. A leak usually means information got out without a deliberate attack, such as a mistake or a misconfiguration.
Do companies have to tell me about a leak?
Often, if it's likely to cause you serious harm. Under UK GDPR, an organisation should report a qualifying breach to the ICO within 72 hours, and tell the people affected where the risk is high. Rules differ by country.
Can leaked data be removed?
Not from every place. Copies can spread. You can remove listings on data brokers and people-search sites, and change credentials that leaked.
Sources
Something wrong or out of date? Tell us and we'll re-check it.