datalek

A datalek is the exposure of personal or sensitive data to unauthorized individuals or systems. It can result from hacking, misconfiguration, insider actions, or accidental sharing. In privacy and information security, the term is used to describe incidents where data protected by law becomes accessible to unauthorized parties.

Common causes include misconfigured cloud storage, insecure APIs, weak authentication, phishing, malware, stolen devices, and human error. Data can be exposed through inadequate access controls, sloppy third‑party handling, or errors in data processing.

Types range from accidental disclosures that make data publicly visible to deliberate exfiltration by attackers. The impact can involve personal identifiers, contact details, financial information, or health records. The scale can vary from small to millions of records.

Consequences include harm to individuals, financial loss, and reputational damage, along with regulatory penalties. Under the European Union's GDPR, organisations must notify the supervisory authority within 72 hours of discovery and inform affected individuals when there is a high risk to rights and freedoms.

Prevention and response rely on a risk‑based approach: encrypt data at rest and in transit, enforce least‑privilege access, conduct regular security testing, maintain monitoring and logs, and implement an incident response plan. Training and clear breach notification procedures with partners are essential.

See also data breach, data protection, GDPR, information security.