What is a data breach? A data breach occurs when personal, confidential or otherwise protected information is accessed, disclosed, copied, changed, lost or destroyed without authorisation. It can happen through a cyberattack, a misplaced device, a wrongly addressed email, a misconfigured database, an insider mistake or a supplier’s security failure. A breach does not always involve a hacker breaking into a system; human error and poor access controls can expose information too.
A data breach can affect names, identity numbers, contact details, financial records, health information, passwords, customer histories or business secrets. The consequences depend on what information was exposed, how many people were affected, whether the data can be used to cause harm and how quickly the organisation contains the incident.
Quick notes: A security incident is not automatically a reportable personal-data breach. In Singapore, an organisation must assess a suspected personal-data breach under the Personal Data Protection Act (PDPA). A breach is notifiable when it is likely to result in significant harm to an affected individual or is of significant scale, subject to the statutory rules. Once the organisation determines that it is notifiable, it must notify the PDPC as soon as practicable and no later than three calendar days after the day of that determination; affected individuals must also be notified where required.
Data breach versus cyberattack: what is the difference?
A cyberattack is an attempt to compromise a system, account, network or data. A data breach is an incident in which protected information is exposed, accessed, disclosed, altered or lost without authorisation. A cyberattack may cause a data breach, but not every attack succeeds in exposing information. A data breach can also happen without a cyberattack, such as when a staff member sends a spreadsheet to the wrong recipient.
A ransomware attack, for example, may encrypt files and disrupt operations. If the attacker also copies customer records and threatens to publish them, there may be both an operational security incident and a data-exposure incident. The organisation must investigate what information was accessed or taken rather than assume that encryption alone tells the full story.
What information can be exposed in a data breach?
- Identity information: full names, identity numbers, dates of birth, addresses and contact details.
- Account credentials: usernames, password hashes, authentication tokens, recovery codes and security-question answers.
- Financial information: bank details, card data, transaction records, invoices and payment histories.
- Health and sensitive records: medical information, disability data, insurance claims and other details that could expose a person to harm or discrimination.
- Workplace and education records: payroll, staff files, student data, examination information and disciplinary records.
- Business information: customer lists, contracts, pricing, designs, source code and confidential commercial plans.
The sensitivity of a record depends on context. A person’s email address may appear relatively ordinary, but a list linking that address to a medical condition, a financial difficulty or a password reset process can create serious risk. A breach assessment should consider combinations of information, not just individual fields.
How data breaches happen
Phishing and stolen credentials
Attackers may impersonate a trusted service, colleague or supplier to persuade someone to reveal a password or approve a sign-in. They may then access email, cloud storage or business systems. A compromised account can expose years of correspondence and attached files.
Unpatched software and insecure systems
Software vulnerabilities, weak authentication, exposed remote access and incorrect cloud permissions can allow unauthorised access. A database may be technically functioning as designed but still be publicly accessible because its access settings were configured incorrectly.
Human error and accidental disclosure
A staff member might attach the wrong spreadsheet, place a confidential file in a public folder, send information to an incorrect email address or lose an unencrypted laptop. Accidental disclosure can be just as serious as a deliberate attack.
Insider misuse and supplier incidents
An employee, contractor or vendor may access information beyond their duties. An organisation may also be affected when a supplier that stores or processes its data suffers a breach. Outsourcing a service does not remove the need to understand where information goes and how it is protected.
What happens after a data breach?
The effects can include identity fraud, targeted scams, account takeover, financial loss, reputational damage, operational disruption, regulatory investigation and legal claims. Even information that does not immediately enable fraud can be used to make later messages more convincing. For example, a scammer who knows a person’s recent purchase or school affiliation can impersonate a legitimate organisation more persuasively.
Organisations may need to investigate systems, preserve evidence, disable compromised credentials, restore services, communicate with affected people and improve security controls. A breach response is not complete merely because the affected computer has been switched off or a password has been changed.
How organisations should respond
- Contain the incident: limit unauthorised access, isolate affected systems where appropriate and prevent further disclosure without destroying evidence.
- Establish the facts: determine what data was involved, whose information was affected, when the incident occurred and how the exposure happened.
- Assess harm and scale: evaluate whether the breach is likely to cause significant harm to individuals or is of significant scale under the applicable law.
- Meet notification duties: notify the regulator and affected individuals when the legal threshold is met, within the prescribed timeframe.
- Support affected people: provide clear information about the data involved, practical protective steps and a reliable contact channel.
- Remediate and learn: fix the vulnerability, review access permissions, test controls and document lessons for future prevention.
The order of work may overlap. An organisation should not wait for every forensic detail before containing an active threat. It should also avoid making unsupported public claims about the size or cause of a breach before the evidence is available.
What counts as a notifiable data breach in Singapore?
The Singapore PDPA defines a data breach broadly. It includes unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data, as well as loss of a storage medium or device containing personal data in circumstances where unauthorised handling is likely. Not every breach is automatically notifiable.
A breach is notifiable if it results in, or is likely to result in, significant harm to an affected individual, or if it is, or is likely to be, of significant scale. The PDPC’s regulations and guidance set out the assessment requirements and relevant thresholds. Organisations should use the current statute and PDPC guidance for a real incident rather than relying on a generic online checklist.
Once an organisation determines that a breach is notifiable, section 26D of the PDPA requires notification to the PDPC as soon as practicable and, in any case, no later than three calendar days after the day of that determination. Where individual notification is required, the organisation must notify affected individuals in a reasonable manner on or after notifying the Commission. This is a statutory deadline triggered by the notifiability determination—not a blanket rule that every security incident must be reported within three days.
Official references: Personal Data Protection Act 2012, current text and the PDPC Guide on Managing and Notifying Data Breaches.
What should an individual do after receiving a breach notice?
- Read the notice carefully: identify which organisation is contacting you, what information may be affected and what dates are relevant.
- Verify the sender independently: use the organisation’s official website or a phone number you already trust; do not rely on links or numbers in an unexpected message.
- Change exposed passwords: start with the affected account and any other account where the same password was reused. Use a unique password for each service.
- Secure important accounts: enable multi-factor authentication, review recovery details and sign out unfamiliar sessions.
- Watch for suspicious activity: review bank transactions, account alerts, credit reports where relevant and unexpected password-reset messages.
- Be alert to follow-on scams: criminals may pretend to help you recover money or secure your account. Do not disclose one-time passwords or approve unexpected sign-in requests.
If payment details or bank accounts may be compromised, contact the bank using its official channel promptly. If an identity document or government credential is involved, follow the relevant issuing authority’s current instructions. Keep the breach notice and records of any suspicious activity.
How organisations can reduce data-breach risk
- Collect less information: do not retain personal data without a clear business or legal need; define retention and deletion rules.
- Restrict access: use role-based permissions, least privilege and prompt removal of access when people change jobs or leave.
- Protect accounts: require strong authentication, multi-factor authentication and secure password practices for important systems.
- Patch and test: maintain software, check exposed services, scan for weaknesses and test recovery procedures.
- Encrypt and back up: protect data at rest and in transit, and keep backups separated from routine user access.
- Train people: practise safe handling of attachments, cloud links, devices and unexpected requests.
- Review suppliers: understand what data vendors process, what safeguards they use and how they will report an incident.
Common data-breach misconceptions
- ‘A breach only happens when hackers steal data.’ Accidental disclosure, lost devices and insider misuse can also be breaches.
- ‘A failed login attempt is automatically a data breach.’ It may be an attempted attack, but the organisation must establish whether protected information was actually compromised or lost.
- ‘Every breach must be reported to everyone.’ Notification duties depend on the statutory criteria and circumstances.
- ‘Changing one password fixes the whole incident.’ The cause may involve tokens, email forwarding, devices, supplier access or other accounts.
- ‘If a company says no evidence of misuse was found, there is no risk.’ Absence of detected misuse is not proof that exposed information cannot be used later.
Frequently asked questions about data breaches
What is a data breach in simple words?
It is an incident in which protected information is accessed, disclosed, altered, copied, lost or destroyed without authorisation.
Is a data breach always caused by hackers?
No. Human error, lost devices, misconfigured systems, supplier incidents and insider misuse can also expose data.
What is the difference between a data leak and a data breach?
The terms are often used similarly. ‘Data leak’ commonly describes information becoming exposed, while ‘data breach’ is the more formal term used in many security and legal contexts. The legal definition depends on the relevant jurisdiction.
Does every Singapore data breach have to be reported to PDPC?
No. The organisation must assess whether the breach meets the notifiable-breach criteria, including significant harm or significant scale, and follow the PDPA’s notification rules.
How quickly must a notifiable breach be reported in Singapore?
Under section 26D, the organisation must notify the PDPC as soon as practicable and no later than three calendar days after the day it determines that the breach is notifiable.
What should I do if my information was exposed?
Verify the notice, secure affected accounts, change reused passwords, enable stronger authentication, monitor for suspicious activity and contact relevant financial institutions if payment information may be affected.
Continue learning at eduKateSG
For the social-engineering method frequently used to steal credentials, read What Is Phishing?. For account protection, continue with What Is a Password Manager? and the practical Anti-Malware, Firewalls and Encryption guide.
Sources and further reading
The Singapore Personal Data Protection Act 2012 is the primary legal source for the notification obligation. The Personal Data Protection Commission publishes organisational guidance and breach-management resources. For Singapore-specific response advice, consult the Cyber Security Agency of Singapore. This is general education, not legal advice or an assessment of a particular incident.