Lesson 17: Data Leaks vs. Data Breaches and Legality

The first thing to cover in this section is the difference between a data leak and a data breach.

Data Leak

A data leak is an unintentional exposure of sensitive data. This could happen through various avenues, like:

• Sending confidential information to the wrong recipient
• Overlooked vulnerabilities, such as a misconfigured server or unprotected databases

People could take advantage of these exposures to download data from a server. Importantly, no one has intentionally compromised a secure server and stolen anything — the data was already being leaked.

Data Breach

A data breach is the opposite: an intentional unauthorized access to sensitive information. A cyber criminal would:

• Hack a company and download its database
• Sell it or release it to the public

To do this, the hacker exploits security vulnerabilities in a server. A data leak is unintentional, while a data breach is hacking a protected database without permission — which is obviously illegal.

Legality of Downloading and Accessing Leaked or Breached Databases

Normally, when you download a leaked or breached database, you might find an email address and password. As an OSINT investigator, penetration tester, journalist, etc., you are not allowed to use the person's password to log in to their account because you do not have permission.

If the data is publicly available, possessing it should not be a problem, as leaked or breached databases are already out there for free. They are used by:

• Security researchers and penetration testers for good (e.g., to protect companies from cyber criminals)
• Cyber criminals for malicious purposes (e.g., logging into accounts, changing passwords, or posting unauthorized content)

Important disclaimer: I'm not a lawyer. I highly recommend consulting a lawyer in your country to confirm legality. If working in a company, also check internal policies on downloading or possessing such databases.