A website outage alone does not establish a data breach or data theft. An outage means a site or system is unavailable, while a data breach means an unauthorized person accessed or acquired personal information. Readers see both events as site trouble, but they trigger different risks and responses. Downtime calls for restoration and communication, while suspected theft calls for evidence of access.
Table of Contents
- What makes an incident a breach
- Why downtime points to availability
- Major outages can have no attacker
- What evidence can prove theft
What makes an incident a breach
A breach turns on access, not availability. NIST defines a breach as loss of control or unauthorized disclosure or acquisition where an unauthorized person accesses personal information, as described in the NIST draft. Florida law uses the same access test.
It defines breach as unlawful and unauthorized acquisition of computerized data that materially compromises personal information, so mere unavailability is not covered. The FTC also limits special breach notice to a notification event, meaning unauthorized acquisition of unencrypted customer information affecting 500 or more consumers, according to the FTC press release. Access alone can create a presumption, but companies may rebut it with evidence.
Why downtime points to availability
Many outages are availability failures. CISA defines a denial-of-service attack as an event where legitimate users cannot access systems or network resources because of malicious traffic, an availability problem rather than proven disclosure, as explained in the CISA guidance. The FBI and CISA made the same distinction for election infrastructure.
They said distributed denial-of-service attacks could hinder access to information while underlying data stayed uncompromised. Verizon's annual breach research keeps the categories separate. It treats broad security incidents as events affecting confidentiality, integrity or availability, and reserves breach for confirmed data disclosure. Denial of service usually disrupts service without producing that disclosure.
Major outages can have no attacker
A global disruption can come from a bad update. The July 19, 2024 CrowdStrike/Falcon Windows outage grounded flights and disrupted banks after a defective content update. Company CEO George Kurtz called it a defect, explicitly not a security incident or cyberattack.
Users could not work, but downtime by itself did not show that customer data was viewed, copied or stolen. That example matters for website readers. A blank page, failed checkout, or login error proves the service failed. It does not identify who, if anyone, touched stored data.
What evidence can prove theft
Treat an outage as a lead, then look for access. The FTC directs businesses to use forensics, preserved backups and access logs to determine who entered systems, whether encryption was active, and what was taken.
Useful checks include: Act on what those records show. Restore service, rotate exposed credentials, notify the right parties, and keep monitoring for misuse tied to the accessed accounts.
- Review access and authentication logs for unknown accounts, times and data paths
- Confirm whether affected data was encrypted and whether keys stayed protected
- Compare systems to clean backups to identify changed, exported or deleted files
- Preserve evidence before rebuilding so investigators can reconstruct the sequence
You Might Also Like
- Legal Aid Agency Data Breach: Why You Should Not Search for Copies of Leaked Case Files
- Medical Data Breach: Protecting Insurance and Patient Accounts
- M&S Data Breach: What Masked Card Details Mean for Customers