A third-party data breach is a data breach with specific criteria. First, the data must be stolen or compromised by a third party. Second, the third party must have its IT infrastructure on its own separate environment from the organization suffering the data leak. Third, the data or information must be sensitive or confidential.