Pick up any tech section and you’ll likely find these three terms used interchangeably, as if they’re just different ways of saying the same thing.
They’re not. Each points to a distinct kind of incident, and confusing them isn’t just a minor slip, as it can shape how seriously people take a story, and how fairly a company gets treated in the coverage that follows.
What Is A Data Breach?
At its core, a data breach is about access that shouldn’t have happened. Someone, usually a hacker, gets past a barrier they had no business crossing, whether that’s guessing a weak password, slipping through an unpatched server, or convincing an employee via phishing email to hand over their login. What makes it a breach isn’t whether the data later shows up online or gets sold somewhere; it’s simply the moment that line gets crossed.
What Is a Data Leak?
A leak doesn’t necessarily involve a hacker at all. It’s what happens when sensitive information gets exposed by accident or a misconfigured cloud database left open to the internet, an employee emailing the wrong spreadsheet, or a company’s own server settings quietly leaving customer records searchable. No malicious actor needs to break in; the door was simply left unlocked. That said, a leak can easily turn into a breach if someone finds that open door and decides to walk through it with bad intent.
What Is A Cyberattack?
This is the broadest of the three terms, and it covers the entire spectrum of malicious digital activity and not just theft of data. Ransomware that locks up a hospital’s systems, a distributed denial-of-service attack that takes a website offline, or malware planted to sabotage industrial equipment all count as cyberattacks, even if not a single file changes hands. A data breach is often the outcome of a cyberattack, but plenty of cyberattacks have nothing to do with stealing information at all.
For journalists and readers alike, getting these terms right isn’t just pedantry. Calling an accidental leak a “hack” overstates the threat, while calling a targeted breach a mere “leak” can understate how serious an incident really is. Precision here shapes how the public and regulators respond.
Chanakya Niti: 7 Habits of Successful People That Still Matter Today