Personal data leakage is the exposure, disclosure, loss, or unauthorized access to information that identifies or can be linked to a person. It can involve confirmed copying or publication, but suspected exposure may also require investigation and incident handling. A database record count does not necessarily equal the number of affected individuals, and unauthorized access alone does not prove that data was stolen.
Leakage matters because personal information can enable fraud, phishing, identity abuse, or other privacy harms, and may trigger legal or regulatory notification duties. Security teams investigate which data was reachable, preserve server and network logs, and look for unusual queries, bulk reads, or transfers. They should distinguish confirmed facts from unknowns, assess applicable reporting requirements, and notify affected people when required.