Clients often ask us to explain the difference between a privacy
"hack" and a "breach" where an individual's
personal information is concerned. Indeed, while there is generally
understood to be a difference between these concepts, confusion
remains with respect to how each is precisely defined - and how
such definitions inform a company's legal obligations.
A hack is commonly associated with a malicious intent to modify
hardware or software in a way that was not intended by the
developer. A privacy breach can also have dire consequences, but is
usually associated with human error in that information is left
unintentionally unsecured.
Some have even tried to distinguish a "hack" from a
"crack," noting that hacking is not always done for
malicious purposes, whereas criminal intent always underlies a
"crack".1
