Data breaches occur when a cyberattacker gains access to an organization’s data. This can happen by taking advantage of access to an organization’s network and systems or identifying data that is accidentally exposed where it is accessible to the public (like cloud storage). Some of the main ways a data breach can occur include: Lost/Stolen Credentials: Compromised credentials are an invaluable tool for a cybercriminal looking to carry out a data breach. With access to an employee’s credentials, an attacker can log into their account and take advantage of their legitimate access to steal sensitive data. Credentials for SaaS solutions like Office 365 and G Suite are a common target due to the amount of valuable data stored in email and cloud-based storage and the opportunity to phish other employees using the compromised internal email. Lost/Stolen Equipment: A lost or stolen laptop, mobile phone, or USB drive can be a treasure trove of sensitive information. For example, in 2018, a USB drive was found in Heathrow airport that detailed the security protocols and plans for the Queen’s travel. In the wrong hands, this data breach could have led to a kidnapping or an assassination. Social Engineering Attacks: Social engineering attacks, like phishing, are designed to trick someone into taking actions that hurt them and/or their organization. These attacks can be designed to steal sensitive data directly or to gain access to credentials that can be used for second-stage attacks. Insider Threats: Insider risk is one of the leading causes of data breaches. As mentioned earlier, insiders can place an organization’s sensitive data at risk in a number of different ways. Vulnerability Exploits: Web application vulnerabilities are a major target of cybercriminals. These applications are publicly accessible and are connected to databases full of sensitive information that an attacker may be able to access with a successful exploit. Malware Infections: Malware can carry out a data breach in a number of different ways. Malware can attempt to gain direct access to sensitive databases and send the information to the attacker or attempt to steal user credentials that the attacker can use directly. Physical POS Attacks: Point of Sale (POS) devices like credit card readers and ATMs are targeted by both physical and virtual skimming attacks. In both cases, the attacker reads the information off of credit cards inserted into the machine, enabling them to use or steal the breached financial information. Credential Stuffing: Employees commonly use weak or reused passwords on their personal and business accounts. Credential stuffing attacks test common and breached passwords to see if they can guess a user’s credentials and gain access to their accounts. Lack of Encryption: Internet traffic is routed over untrusted infrastructure, which makes it potentially vulnerable to eavesdropping. If encryption - in the form of SSL/TLS - is not used, an eavesdropper may be able to read sensitive information included in a user’s traffic. Misconfigured Web App or Server: Misconfigurations can be as damaging to a web app or server as software vulnerabilities. In 2019, Capital One experienced a massive data breach that took advantage of a misconfigured web application firewall (WAF) to access and steal data from the organization’s AWS deployment.