Sensitive Data Exposure: Types of Sensitive Data and Fixes
Many teams believe a data incident needs a hacker. Often it does not. A storage bucket left public, an API that returns too many fields or a password file without proper hashing can leak sensitive data with no break-in at all. That is sensitive data exposure, and it is one of the most preventable security failures.
What Is Sensitive Data Exposure?
Sensitive data exposure happens when information that should be protected, such as personal details, card numbers, health records or passwords, is left accessible to people who should not see it. Causes include missing encryption, misconfigured storage, overly broad access and careless code. Exposure can lead to a breach, but it starts as a weakness.
Exposure as a Vulnerability (OWASP and CWE-200)
OWASP listed Sensitive Data Exposure in its 2017 Top 10, then renamed the category Cryptographic Failures in 2021 to focus on the root cause. It remains in the OWASP Top 10:2025. MITRE’s CWE-200, “Exposure of Sensitive Information to an Unauthorized Actor,” describes the wider weakness.
What Is Sensitive Data?
Sensitive data is any information that could cause harm to people or a business if disclosed, changed or lost. Harm can mean identity theft, fraud, discrimination, legal penalties or competitive damage.
Sensitive Data vs Personal Data
Personal data is any information about an identifiable person. Sensitive data is a narrower, higher-risk subset, plus non-personal business secrets. A work email address is personal data; a medical diagnosis or bank account number is sensitive data.
Types of Sensitive Data
Personally Identifiable Information (PII)
Names combined with identifiers such as Social Security or National Insurance numbers, passport details and dates of birth.
Financial and Payment Card Data
Card numbers, security codes, bank account details and transaction histories, covered in part by PCI DSS.
Health Data (PHI)
Medical records, diagnoses, prescriptions and insurance details. In the US, HIPAA protects health information held by covered entities.
Credentials, API Keys and Secrets
Passwords, tokens, private keys and connection strings, which can unlock everything else.
Biometric and Genetic Data
Fingerprints, face scans, voiceprints and DNA results, which cannot be changed if exposed.
Business Confidential Data and Intellectual Property
Source code, product designs, contracts, pricing and strategy documents.
Legally Protected Categories (UK GDPR Special Category Data and CPRA Sensitive Personal Information)
UK GDPR defines special category data, including health, racial or ethnic origin, religious beliefs, sexual orientation, biometric and genetic data. California’s CPRA defines sensitive personal information, including government IDs, precise geolocation and account login details.
Data Exposure vs Data Breach
Exposure is the condition: data is reachable by the wrong people. A breach is the event: someone really accesses, copies, changes or destroys the data. Fixing exposures early stops them from becoming breaches, which usually carry notification duties and fines.
Common Causes of Data Exposure
Missing or Weak Encryption
Data sent over plain HTTP or stored unencrypted, or protected with outdated algorithms, can be read if intercepted or copied.
Misconfigured Cloud Storage and Databases
Storage buckets, databases and backups set to public, or reachable without authentication, are a frequent source of large leaks.
APIs That Return Too Much Data
APIs that send full records and rely on the app to hide fields expose everything to anyone who calls them directly.
Hard-Coded Secrets and Verbose Error Messages
Keys in source code or public repositories, and error pages that show stack traces or database details, give attackers a head start.
Excessive Access Permissions
Staff, contractors and service accounts with more access than they need widen the circle of exposure.
Employees Pasting Data Into AI Tools
Customer records or code pasted into public AI tools may leave your control, depending on the tool’s terms and settings.
Attacks That Exploit Exposed Data
Attackers use exposed data for account takeover, identity theft, card fraud, phishing that quotes real details, extortion and further intrusion using leaked credentials. Exposed passwords stored with weak hashing can be cracked and reused on other services.
Real-World Exposure Examples
- A public cloud bucket holding customer ID scans
- A mobile app API returning other users’ full profiles when an ID is changed in the request
- An API key committed to a public code repository
- A spreadsheet of salaries shared with “anyone with the link”
- Passwords stored with an old, fast hash that is easily cracked
The Impact: Fines, Notification Duties and Lost Trust
US: FTC, HIPAA, PCI DSS and State Breach Laws
The FTC can act against companies with unreasonable data security. HIPAA requires breach notification for protected health information. PCI DSS sets card data rules enforced through payment brands. Every US state has a breach notification law.
UK: UK GDPR, ICO and 72-Hour Reporting
Under UK GDPR, organizations must report a personal data breach to the ICO within 72 hours of becoming aware of it, unless it is unlikely to pose a risk to people. High-risk breaches must also be reported to the people affected.
How to Prevent Sensitive Data Exposure (10 Fixes)
Find and Classify Your Sensitive Data
You cannot protect what you cannot find. Use discovery tools to locate sensitive data and label it by risk.
Encrypt Data at Rest and in Transit
Use TLS for all traffic and strong encryption for stored data, with keys managed separately.
Hash Passwords With Modern Algorithms
Store passwords with slow, salted algorithms such as Argon2id, bcrypt or scrypt, never plain or fast hashes.
Minimize, Mask and Tokenize
Collect only what you need, delete what you no longer use, and mask or tokenize data that staff and systems do not need in full.
Lock Down Cloud Storage and APIs
Block public access by default, require authentication, and return only the fields each request needs.
Enforce Least-Privilege Access
Grant the minimum access each role requires and review it regularly.
Scan Code for Secrets
Use secret scanning in repositories and pipelines, and rotate any key that leaks.
Deploy DLP and DSPM
Data loss prevention stops sensitive data leaving through email, web and devices; data security posture management finds risky exposure across cloud data stores.
Set Rules for AI Tool Use
Approve specific AI tools, set what data may be entered, and use enterprise settings that limit retention.
Test Regularly and Have a Response Plan
Run configuration reviews and penetration tests, and keep an incident response plan ready for leaks.
Your Next Steps on Sensitive Data Exposure
Exposure is usually a setting, not a sophisticated attack, which makes it fixable. This month:
- Scan cloud storage for public access.
- Run secret scanning on your code repositories.
- Check how passwords are hashed.
- Review who can reach your most sensitive data sets.
For help finding and closing exposure in your systems, contact Cyber Security Solutions Ltd through our contact page.
FAQs
Misconfiguration is among the most common causes, especially cloud storage, databases and backups left publicly accessible or without authentication. Other frequent causes are missing encryption, APIs that return more data than needed, hard-coded secrets in code and access permissions that are far broader than each role requires.
On their own, a name and address are personal data rather than sensitive data under most definitions. They become higher risk when combined with other details, such as dates of birth, account numbers or health information, which can enable identity theft or fraud. Protect them according to the combined risk.
Not under that name. OWASP renamed Sensitive Data Exposure to Cryptographic Failures in its 2021 list to focus on the cause rather than the symptom, and that category remains in the OWASP Top 10:2025. Related issues also appear under broken access control and security misconfiguration.
It depends on whether exposure became a breach and who was affected. Under UK GDPR, report personal data breaches to the ICO within 72 hours unless they are unlikely to pose a risk. In the US, state breach laws, HIPAA and sector rules set notification duties and timelines.
Encryption greatly reduces the impact, because stolen encrypted data is unreadable without the keys. It does not solve everything: if an application decrypts data for anyone who calls an API, or keys are stored beside the data, exposure still happens. Combine encryption with access control and good key management.
Use sensitive data discovery tools that scan file shares, databases, cloud storage and SaaS apps for patterns such as card numbers, ID numbers and health terms. Pair scanning with interviews of data owners, because some sensitive information, such as contracts or designs, is hard to detect by pattern alone.
