A breach is unauthorized access to a system, account, or dataset. It can happen when an attacker steals credentials, exploits a vulnerability, abuses remote access, or tricks a user into granting entry. A breach does not always mean data was copied, but it does mean an attacker got past intended security boundaries.
Breach matters because even limited access can expose sensitive records, enable lateral movement, or create extortion risk. In cyber defense, teams look for signs such as unusual logins, new devices, privilege changes, and unexpected data access. Good controls like multi-factor authentication, segmentation, least privilege, and centralized logging reduce the chance of breach and help confirm how far an intruder got if one occurs.