Also called: Account data compromise, Breach, Data compromise, Data leak, Data spill
What a data breach is
A data breach is an incident in which sensitive information is accessed, viewed, stolen, or used without permission. A breach does not automatically prove that information was stolen or misused. It means information was exposed to someone who was not authorized to access it.
For your business, exposed information could include payment card data, customer names and contact details, personal health information, bank details, or employee records. In card payments, the primary account number is cardholder data. A breach can also involve a printed record, a lost device, an incorrectly exposed website, or an intrusion into a computer system.
A data breach has no standard processing-statement fee, but investigation, notification, and recovery can still cost your business.
How breaches happen
A breach can start with a stolen password, malware, a misplaced laptop, a staff mistake, or a website or database configured to reveal information. Payment terminals and other payment systems are also targets. Memory-scraping malware is one method attackers use to capture data while a computer is processing it.
The amount of exposed information depends on what was accessible and what your systems stored. PCI DSS prohibits storing sensitive authentication data, such as a card security code, after authorization. Storing less sensitive information reduces what an attacker can take.
What a breach means for your business
The financial impact is not a fixed processing fee. Your costs depend on the incident and can include investigation, system repair, customer communications, legal advice, and identity-theft support. Contracts and applicable laws can also affect your responsibilities. There is no universal breach charge or standard dollar amount that applies to every merchant.
A breach involving card data can bring scrutiny of your payment environment and its PCI DSS compliance. PCI DSS v4.0.1 is the current version as of 2026. The 51 future-dated requirements in PCI DSS v4.0 became mandatory on March 31, 2025, including controls for payment-page scripts and multi-factor authentication for access into the cardholder data environment.
A data breach does not have a standard line on your processing statement. If an incident results in a processor or other party billing you under a contract, review the specific description and supporting documentation. Do not assume a routine PCI non-compliance fee is itself proof that a breach occurred.
Response and notification
Every US state, the District of Columbia, Puerto Rico, and the US Virgin Islands has a law requiring notice for certain breaches of personal information. The information covered and notification deadlines depend on the applicable law and circumstances, so there is no single nationwide deadline to apply to every incident.
A response can involve determining what information was exposed, preserving evidence, fixing the weakness, and notifying affected people or organizations when required. If financial information or Social Security numbers were exposed, the FTC recommends considering at least one year of free credit monitoring or other identity-theft support. Breach-related phishing is another risk: customers can receive convincing messages that use details from the incident.
What you can actually change
- Limit stored data. Keep only the customer and payment information your business needs. Never store sensitive authentication data, including a card security code, after authorization.
- Restrict access. Give employees access only to information needed for their jobs. Use multi-factor authentication for access to systems containing cardholder data.
- Check PCI controls. Confirm your PCI DSS validation is current and that your security controls cover payment pages, devices, and connected systems. A PCI non-compliance fee is a billing issue to resolve, not proof of a breach.
- Preserve evidence. If you suspect an incident, involve qualified security and legal professionals. Preserve affected equipment and records; do not turn off a machine before forensic experts advise you.
Frequently asked questions
Does a data breach automatically mean card numbers were stolen?
No. A breach means information was accessed or exposed without authorization, but it does not by itself establish that data was copied or misused. The investigation must determine what information was accessible and what happened to it.
Will a data breach appear as a fee on my merchant statement?
There is no universal data-breach fee or standard statement line. A processor or another party could bill costs under a specific contract, but a charge needs to be reviewed against its description and supporting records. A PCI non-compliance fee alone does not prove a breach.
How quickly do I have to notify customers after a breach?
There is no single notification deadline for every US business. All states and several US territories have breach-notification laws, and the deadline depends on the information involved and applicable law. Get qualified legal advice promptly to determine your obligations.
What is memory scraping?
Memory scraping is a form of malware activity that captures information while a computer is processing it in memory. It is one possible way card data can be exposed, not another name for every data breach.