What Is a Data Breach? A Plain Guide for Businesses

A data breach is when someone who shouldn't see your data gets to see it, copy it or change it. It can be a hacker stealing customer records, a staff member emailing a spreadsheet to the wrong person, or a cloud folder left open to the internet. For a business, a data breach means real costs, legal duties and lost trust, but most breaches come from a small set of causes you can control.

What counts as a data breach

The data doesn't have to be "stolen" in a dramatic way. Any of these is a breach:

• A hacker logs in with a staff member's stolen password and downloads files.
• Ransomware (malware that locks your files and demands payment) copies data before encrypting it.
• An employee loses an unencrypted laptop with patient records.
• A developer leaves a database or storage bucket public by mistake.
• A supplier who holds your data gets hacked.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), what matters most is personal data: names, IC numbers, phone numbers, health details, bank details and so on.

How breaches usually happen

Verizon's Data Breach Investigations Report studies thousands of real breaches each year. The 2026 edition, published in May 2026, shows a few clear patterns (figures from its executive summary):

• Unpatched software (known bugs that were never fixed) is now the top way in, at 31% of breaches.
• Stolen or weak logins, the top way in the year before, dropped to 13%. They are still a major risk.
• Third parties such as suppliers and software vendors were involved in 48% of breaches.
• Ransomware was present in 48% of breaches, up from 44%. The 2025 edition found it in 88% of breaches at small and mid-sized organisations.

Notice what is missing: movie-style genius hackers. Most breaches start with a reused password, a phishing email or a server nobody updated.

What a data breach costs

IBM's Cost of a Data Breach Report 2026, published in July 2026, put the global average cost at US$4.99 million. The 2025 report had it at US$4.44 million, and found it took an average of 241 days to find and contain a breach.

For our region, the ASEAN average in the 2026 study was US$4.12 million, a record high, based on just 26 organisations. These are mostly larger firms, so a small business will pay less in dollars. But it will feel it more.

The bill usually includes:

• Investigation and recovery (forensics experts, rebuilding systems)
• Downtime and lost sales
• Notifying customers and handling complaints
• Legal costs and possible fines
• Customers who quietly go elsewhere

IBM's 2025 report also found that firms who spotted the breach themselves saved about US$900,000 compared with those who heard about it from the attacker. Finding it early pays.

Your legal duties in Malaysia

Since 1 June 2025, PDPA breach notification is mandatory. Under the Commissioner's Data Breach Notification Guideline, as summarised by DLA Piper and CMS:

• Tell the Personal Data Protection Commissioner within 72 hours of the breach happening or of you being told about it, for a personal data breach that causes, or is likely to cause, significant harm.
• Tell the affected individuals without unnecessary delay, and no later than 7 days after notifying the Commissioner, where there is a risk of significant harm.
• "Significant harm" includes financial loss, identity fraud, physical harm, or exposure of sensitive data such as health records. A breach affecting more than 1,000 people also needs reporting to the Commissioner.
• Keep a breach register and keep records for at least 2 years.

If you are part of national critical information infrastructure (banks, utilities, healthcare and similar), the Cyber Security Act 2024 adds separate reporting to NACSA. I cover that in the cyberattack response plan. Check the exact rules with your lawyer; this is a summary, not legal advice.

How to prevent most data breaches

You don't need a big budget. Start with the causes above.

1. Turn on multi-factor authentication (MFA) for email, cloud apps, banking and remote access. MFA asks for a second proof, like a code on your phone, so a stolen password alone isn't enough.
2. Use a password manager so every account has a unique password. Reused passwords are how leaks like the 16 billion password leak turn into break-ins.
3. Patch quickly. Turn on automatic updates for laptops and phones. Put internet-facing systems (VPNs, firewalls, websites) at the top of the list.
4. Give people only the access they need. The clinic receptionist doesn't need the accounting folder. This is the core idea of zero trust.
5. Encrypt laptops and phones. A lost device then becomes an equipment loss, not a data breach.
6. Keep less data. If you don't need customers' IC numbers, don't collect them. Delete old records you no longer need.
7. Check your suppliers. Ask what data they hold, how they protect it, and how fast they'll tell you if something goes wrong.
8. Back up properly, with at least one copy attackers can't delete. See immutable backups.
9. Train staff to spot phishing and to report mistakes fast, without fear of blame.

What to do if you have a data breach

Keep it simple and fast:

1. Contain it. Disconnect affected machines from the network (don't switch them off; evidence lives in memory). Reset compromised passwords and revoke sessions.
2. Find out what happened. What data, how many people, how did they get in, is it still happening? Bring in an incident response firm if you can't answer these.
3. Write everything down. Times, actions, who did what. You'll need it for regulators and insurers.
4. Notify the Commissioner and affected people within the PDPA timelines above, if they apply.
5. Fix the root cause before you call it done. Otherwise the attacker walks back in.
6. Tell customers clearly what happened and what they should do, such as changing passwords or watching for scam calls.

Conclusion

A data breach is rarely about clever hackers. It's usually unpatched systems, stolen logins or a supplier's weak spot. Fix those, keep less data, and have a plan for the 72-hour PDPA clock, and you've dealt with most of the risk.

Quick answers

What is the difference between a data breach and a cyberattack?

A cyberattack is any attempt to harm your systems. A data breach is when data is actually exposed. Many attacks don't cause a breach, and many breaches (like a misdirected email) aren't attacks at all.

Do small businesses in Malaysia have to report a data breach?

If you process personal data in commercial transactions, the PDPA applies regardless of size. Since 1 June 2025, breaches likely to cause significant harm must be reported to the Commissioner within 72 hours.

What is the most common cause of data breaches?

In Verizon's 2026 report, exploited software flaws were the top way in, at 31% of breaches, overtaking stolen credentials (13%). Fast patching, MFA and unique passwords cover most of the risk.

How much does a data breach cost?

IBM's 2026 study puts the global average at US$4.99 million and the ASEAN average at US$4.12 million, mostly for larger organisations.