SECAI Core · phase 11 of 15
Data breach
When confidential or private data is read, copied, or changed without authorization. Data breach events may have notification and reporting requirements.
The Explain card
- Plain English
- A data breach is confidential or private data being read, copied, or changed without authorization. Beyond the technical damage, breaches often trigger legal notification and reporting duties.
- Example
- A misconfigured storage bucket holding an AI company's chat logs is left public. Customer conversations, including pasted medical details, are downloaded by strangers, and regulators must be notified.
- Why it matters
- AI systems concentrate sensitive data: prompts, logs, and training sets. Defenders treat all of it as breach-worthy, minimize retention, and have a response plan ready before it is needed.
- Hook
- Data walked out, and now the lawyers walk in.
Where it sits in the deck
Phase 11: Threat Landscape: Attack Vectors and Adversarial Techniques
With defences named, learn what they must defend against — the full catalogue of attack techniques targeting AI systems, their inputs, outputs, training pipelines, and supply chains.
