What is Data Leakage?
Updated: 3 days ago
Data leakage is the unauthorised exposure, disclosure or movement of information beyond the people, systems or locations that are supposed to have access to it. It can happen accidentally, through a configuration mistake or human error, or deliberately through malware, credential abuse or an insider copying information.
The important distinction is that data leakage describes what happens to the information. It is not automatically the same thing as data exfiltration, which usually describes deliberate unauthorised extraction, and it is not automatically the same thing as a personal data breach under UK data protection law. The type of data, how it became exposed and who could access it all matter.
What counts as data leakage?
A useful technical test is to ask whether data has crossed an intended trust boundary. That boundary might be an account permission, a company network, a cloud tenant, an application, a database, a device or simply the group of people authorised to see the information.
An email attachment is sent to the wrong recipient.
A cloud storage bucket or shared folder is made publicly accessible by mistake.
An API returns fields that the requesting user should not be allowed to see.
Credentials, API keys or tokens are committed to a public source code repository.
Malware copies files and sends them to an attacker controlled server.
An employee copies customer or commercial information to a personal account or removable drive.
A lost or stolen device exposes locally stored information because access controls or encryption are inadequate.
Sensitive information appears in logs, analytics, crash reports, screenshots or browser history where it was never intended to be stored.
Not every movement of data is leakage. Authorised backups, lawful sharing, replication between approved systems and normal application traffic can all move information outside the device where it originated without constituting a security failure.
Data leakage vs data breach vs data exfiltration
These terms overlap, but treating them as synonyms hides useful differences.
Data leakage: information becomes exposed or moves outside its intended boundary, accidentally or deliberately.
Data exfiltration: an attacker or unauthorised user deliberately removes data from a system or network. Exfiltration is therefore one possible form of leakage.
Personal data breach: a legal and security concept involving personal data. The ICO describes it as a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
Data loss: information becomes unavailable or is destroyed. That can be a breach even when nobody else receives a copy.
Data exposure: information is accessible to people or systems that should not have access, even if there is no evidence that anyone actually downloaded it.
For the UK legal definition and reporting duties, the ICO personal data breach guidance is the primary reference. The ICO says organisations must document personal data breaches and report qualifying incidents where the breach is likely to result in a risk to people's rights and freedoms.
How does data leakage happen?
1. Human error
Many leaks do not begin with sophisticated intrusion. A recipient is selected incorrectly, a spreadsheet is attached to the wrong message, a sharing permission is set too broadly or sensitive information is pasted into a service that was not approved to receive it. The ICO specifically recognises accidental disclosure to an unauthorised person as a type of personal information breach when personal data is involved.
2. Misconfiguration
Cloud storage, databases, web servers, backup systems and network services can expose data because of incorrect permissions or insecure defaults. A system may be fully patched and still leak information if access control is wrong.
3. Compromised credentials
Phishing, password reuse, credential stuffing or stolen session tokens can allow an attacker to access data using an apparently legitimate account. From the network's perspective, the traffic may resemble ordinary authorised traffic, which is why identity, device context and unusual access patterns matter.
4. Malware and deliberate exfiltration
Malware can search for documents, browser data, credentials and other valuable information, stage it locally, compress or encrypt it and then transmit it elsewhere. Attackers may use ordinary HTTPS, cloud storage, DNS, remote administration tools or other permitted channels to make the outbound traffic less conspicuous.
5. Insider activity
An authorised user can become the source of leakage if they access information for an unauthorised purpose, copy more data than their role requires or move it to an unapproved destination. The account may be valid while the action is not.
6. Application and API flaws
Applications can expose information through broken access control, verbose error messages, insecure APIs, debug endpoints, predictable object identifiers or excessive data returned in responses. Encryption in transit cannot correct an application that willingly sends the wrong information to the wrong user.
What types of information can leak?
Personal data such as names, addresses, account details and identifiers.
Authentication data such as passwords, password hashes, session cookies, tokens and API keys.
Commercial information including pricing, contracts, forecasts and customer lists.
Source code, configuration files, infrastructure diagrams and deployment secrets.
Intellectual property, research, designs and internal documentation.
Financial records and payment related information.
Operational data such as logs, backups, database exports and monitoring information.
Metadata that looks harmless alone but can reveal relationships, locations, timings or system structure when combined with other information.
Where broadband and networking fit into data leakage
A broadband connection is the transport path for a great deal of outbound data, but the connection itself does not determine whether a transfer is authorised. A legitimate cloud backup and a malicious upload can both consume upload bandwidth and both can be encrypted.
That means a fast FTTP or multi gigabit connection can change the rate at which a large leak could theoretically leave a premises, but it does not create the leak. The cause is normally a failure of identity, access control, endpoint security, application security, configuration or policy.
Techie Broadband calculation: ignoring protocol overhead and every other bottleneck, a continuous 100 Mbps outbound flow can move 12.5 MB per second, roughly 45 GB per hour. At 1 Gbps the equivalent theoretical rate is 125 MB per second, roughly 450 GB per hour. At 2.5 Gbps it is 312.5 MB per second, roughly 1.125 TB per hour. These are capacity examples, not claims about how quickly real attackers can steal data.
Real transfers can be constrained by storage speed, encryption, CPU performance, remote server capacity, protocol overhead, congestion, security controls and the upload rate of the broadband product. An asymmetric connection may also have far less outbound capacity than its advertised download figure suggests.
Can encryption stop data leakage?
Encryption is essential, but it solves specific problems rather than every leakage scenario. Encryption can protect stored information and data moving across untrusted networks. TLS protects many internet connections in transit, while end to end encryption can restrict which endpoints can read a conversation or payload.
However, if an authorised application decrypts a customer record and then sends it to the wrong authenticated user, transport encryption simply protects the incorrect disclosure while it travels. If malware runs under a user's account after the user has unlocked an encrypted device, it may be able to read data in its decrypted form.
Can a firewall, IDS or IPS detect data leakage?
Sometimes. A firewall can restrict destinations, ports and protocols. An IDS can identify suspicious patterns and raise alerts. An IPS can attempt to block traffic that matches prevention rules. Packet inspection and deep packet inspection can provide more visibility where the traffic and encryption model allow it.
The limitation is context. A network control may see a user upload 2 GB to a permitted cloud service but not know whether those files are approved project assets or a confidential customer database. Encrypted traffic can also hide payload content. Effective leakage detection therefore usually combines network signals with endpoint, identity, application and data classification information.
How Data Loss Prevention works
Data Loss Prevention, usually shortened to DLP, is a category of controls designed to identify sensitive information and enforce rules around how it can be accessed, copied, uploaded, emailed, printed or otherwise moved. Despite the name, DLP is often used to reduce data leakage as well as literal data loss.
Discover and classify sensitive information.
Apply policies based on data type, user, device, destination or action.
Monitor movement through email, endpoints, browsers, cloud applications and networks.
Warn the user, require justification, quarantine the action or block it where policy allows.
Record events so security teams can investigate patterns and exceptions.
DLP is not a magic filter. Classification can be wrong, legitimate workflows can trigger false positives and encrypted or custom application traffic can reduce visibility. Controls work best when the organisation already knows what information it holds and who genuinely needs access.
How to reduce the risk of data leakage
Use least privilege so accounts can access only the information required for their role.
Require strong authentication and protect privileged accounts more aggressively.
Encrypt sensitive data at rest and in transit where appropriate.
Keep operating systems, applications, browsers, routers and security products patched.
Review cloud shares, storage permissions, public links and API access regularly.
Separate administrative accounts from everyday user accounts.
Avoid placing secrets in source code, configuration repositories, chat logs or support tickets.
Use endpoint controls and DLP where the sensitivity and scale of the data justify them.
Monitor unusual downloads, bulk exports, new destinations and abnormal account behaviour.
Maintain tested backups, remembering that backups protect availability but do not undo a confidentiality leak.
Train people around the real workflows that create accidental disclosure rather than relying on generic security awareness alone.
What to do if you suspect data leakage
Contain the exposure without destroying evidence. Revoke a public link, disable a compromised token, isolate an affected endpoint or restrict an account as appropriate.
Identify exactly what information was involved, where it came from and where it may have gone.
Establish whether the event was accidental, malicious or still ongoing.
Preserve relevant logs, access records, endpoint evidence and timestamps.
Rotate exposed passwords, API keys, tokens and other credentials rather than assuming that removing the public copy is enough.
Check whether personal data is involved and perform the required risk assessment.
Follow the organisation's incident response and legal reporting process. In the UK, use current ICO guidance to determine whether a personal data breach must be reported.
Investigate the root cause and correct the control failure so the same path cannot simply be reused.
If personal information is involved, the ICO says organisations should assess the likelihood and severity of risk to people's rights and freedoms. Not every personal data breach is reportable, but qualifying breaches must be reported without undue delay and, where feasible, within 72 hours of becoming aware of them.
Common misconceptions about data leakage
'If the traffic is encrypted, the data cannot leak.' Encryption can protect the transport while an authorised endpoint sends information to an unauthorised destination.
'A firewall stops data leakage.' A firewall can enforce network policy, but allowed services and valid accounts can still be misused.
'A leak must involve hackers.' Accidental disclosure and misconfiguration are common leakage routes.
'If nobody downloaded the file, there was no problem.' Unauthorised exposure can still be a security incident even when access cannot be proven.
'Deleting the exposed file fixes everything.' Copies, caches, logs, credentials and downstream systems may remain affected.
'More upload speed causes leakage.' Capacity changes how quickly data can move, not whether the movement is authorised.
Frequently asked questions
Is data leakage always deliberate?
No. It can result from mistakes, misconfiguration, insecure software or deliberate theft. The cause matters when investigating the incident, but the security concern is that information reached an unauthorised boundary or audience.
Is data leakage the same as data loss?
No. Leakage is primarily about unauthorised exposure or movement. Data loss is about information becoming unavailable or being destroyed. One incident can involve both.
Does HTTPS prevent data leakage?
No. HTTPS protects data in transit between endpoints. It cannot decide whether the application should have sent that data in the first place.
Can an ISP see leaked data?
It depends on the protocol and encryption. An ISP can carry the traffic and may observe network metadata, but modern encrypted application traffic normally prevents the ISP from reading the payload in transit. That does not make the transfer authorised.
What is the difference between data leakage and exfiltration?
Data leakage is the broader concept and can be accidental or deliberate. Data exfiltration normally refers to deliberate unauthorised extraction of data, often by an attacker or malicious insider.
Key takeaway
Data leakage happens when information escapes the boundary where it is supposed to remain. The most useful way to understand it is not to focus only on hackers or broadband traffic, but on the complete chain: the data, the identity accessing it, the application handling it, the device, the network path and the destination. Encryption, firewalls, IDS, IPS and DLP can all reduce risk, but none replaces correct access control and a clear understanding of who should be able to do what with the data.
To explore the related technical concepts used in this Data Leakage guide, visit our broadband terminology guide.
