# What is Data Leakage and Exposure?

> Data leakage and exposure describe overlapping situations in which data crosses, or becomes accessible beyond, its intended trust or authorization boundary.

- Canonical URL: https://yellowcube.eu/glossary/data-leakage-and-exposure/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Leakage often emphasizes an unintended disclosure path or transfer, while exposure emphasizes an accessible state, such as publicly readable storage, an overly broad permission, or sensitive content in a response. Security practice does not use these labels consistently.

An exposure can exist without evidence that anyone acquired the data. Leakage can be accidental or caused by a product weakness, configuration error, unsafe workflow, or deliberate misuse; it is not limited to attacks over a network.

### Key points

- **Common paths:** Examples include misaddressed messages, public links, exposed storage, excessive permissions, verbose errors, logs containing secrets, unsafe exports, lost media, and uploads to unapproved services.
- **Investigation:** Establish what was accessible or transmitted, for how long, to whom, through which path, and what logs, copies, caches, or downstream disclosures may exist.
- **Recurrence prevention:** Correct the access or data-flow condition, rotate exposed credentials, remove unnecessary copies, improve handling rules, and validate that monitoring covers the relevant path.
- **Important limitation:** Public accessibility does not prove that an unauthorized party viewed or copied data, while missing or incomplete logs cannot prove that no access occurred. Describe confirmed facts and uncertainty separately.

### Related terms

[Data breach](<https://yellowcube.eu/glossary/data-breach/>) · [Data exfiltration](<https://yellowcube.eu/glossary/data-exfiltration/>) · [Data loss prevention (DLP)](<https://yellowcube.eu/glossary/data-loss-prevention/>) · [Data classification](<https://yellowcube.eu/glossary/data-classification/>) · [Security misconfiguration](<https://yellowcube.eu/glossary/security-misconfiguration/>)

### Sources

[MITRE CWE-200: Exposure of Sensitive Information to an Unauthorized Actor](https://cwe.mitre.org/data/definitions/200.html) · [NIST SP 800-53 Rev. 5 Release 5.2.0](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) · [NIST SP 1800-29: Data Confidentiality—Detect, Respond to, and Recover from Data Breaches](https://csrc.nist.gov/pubs/sp/1800/29/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.