What differentiates confidentiality leakage from a data breach?

• A. Leakage is accidental exposure; a data breach is unauthorized access resulting in data exposure.
• B. Leakage is intentional data exposure; a breach is accidental exposure.
• C. Leakage involves only physical theft; a breach involves digital access.
• D. Leakage refers to data in transit; a breach refers to data at rest.

Answer: (A)

The key distinction is how access to the information occurs. Confidentiality leakage happens when data is exposed to someone who shouldn’t see it, usually by accident—things like emailing a document to the wrong person or misconfiguring a system so data becomes visible to unintended users. A data breach happens when an unauthorized party actually gains access to data, typically through a cyberattack, credential theft, or exploitation of a vulnerability, leading to exposure because someone not allowed to see it has accessed it.

So, leakage is about unintended disclosure, while a data breach is about an intruder obtaining access. For example, emailing confidential files to the wrong recipient illustrates leakage, whereas a hacker breaking into a system to copy customer records illustrates a breach. The other ideas don’t fit because leakage is not typically about intentional exposure, it isn’t restricted to physical theft, and it isn’t limited to data in transit versus at rest—the distinction is about accidental exposure versus unauthorized access.