Data breach
Someone who should not have your users' data now has it, whether stolen, exfiltrated, or left in a public bucket by accident.
See it
What it is
A data breach is unauthorized access to data you were trusted with. Note that it does not require a hacker. The most common causes are boring: a public S3 bucket, an unauthenticated database left on the open internet, an API key committed to a repo, an IDOR that let anyone increment an ID, a support tool with no tenant scoping, or an employee laptop. 'Nobody broke in' is not a defense if the door was open.
Vocabulary matters here because the law uses it. An incident is anything suspicious. A breach is confirmed unauthorized access to personal data, and it starts a clock: under GDPR you have 72 hours from awareness to notify the supervisory authority, and US state laws add their own notification duties. Which is why the practical question during an investigation is not 'were we hacked' but 'can we prove what was and was not accessed', and that answer comes entirely from logs you set up months earlier.
The reputational damage almost never comes from the breach itself; it comes from the handling. Sitting on it, minimizing it ('a small number of accounts'), or discovering it from a journalist is what ends careers. Two more traps: 'our vendor was breached, not us' means nothing to your users or to a regulator, and credential stuffing attacks against your login are downstream of somebody else's breach, which is why password reuse makes their bad day yours.
Ask AI for it
Run a breach exposure review of this codebase and infrastructure. Enumerate every place user data lives (databases, object storage, caches, logs, analytics, third-party vendors, backups) and for each one tell me: what personal data it holds, who or what can read it, whether it is encrypted at rest, and whether access is logged. Then flag the specific paths that would turn into a breach: object storage with public or overly broad access, endpoints returning records without an ownership check, credentials in the repo or in environment dumps, log lines printing tokens or full request bodies, and long-lived keys with no rotation. Output a table sorted by how much data one failure would expose.