A data breach happens when unauthorized parties gain access to confidential personal information stored by an organization. What is considered personal information depends on state law but typically includes an individual’s first name (or initial) and last name plus one or more of the following: social Security number, driver’s license number or state-issued ID card number, account number, credit or debit card number, combined with any security code, access code, PIN, or password needed to access an account.