What is the difference between data being accessible and data being accessed?
Accessible means the attacker held a position from which the data could have been reached — credentials with rights over a file share, a foothold on a server hosting a database, a misconfigured storage bucket reachable from the internet. Accessed means the evidence shows the data actually was reached: file access records, database query logs, object-storage access logs naming the objects retrieved.
The gap between the two is often large, and it is often unresolvable. Many environments do not log file-level access at all, which means that after a compromise of a server holding millions of records there may be no technical record either way. That produces the awkward and entirely common position where an organization cannot demonstrate that data was taken and cannot demonstrate that it was not — and how that uncertainty is characterized becomes one of the more contested points in the matter.
How is exfiltration actually established?
Through evidence of data leaving, which is a different artefact from evidence of data being read. The usual sources are network telemetry showing volume and destination, firewall and proxy records of the outbound transfer, staging artefacts on the compromised host where data was collected and compressed before transfer, attacker tooling configured for transfer, and DNS records associated with exfiltration channels.
The strongest evidence is external and sits outside the organization’s control: the data appearing on a leak site, in a criminal marketplace, or in a ransom demand quoting its contents. That removes the inferential step entirely. Absent it, exfiltration is usually established by inference from staging and network evidence, with a confidence level that should be stated honestly rather than asserted flatly.
Does the absence of evidence of exfiltration mean nothing was taken?
Only if the evidence that would have recorded it existed and survived, which is the question that has to be answered before the conclusion is drawn either way. Where full network telemetry was in place, covered the whole intrusion window, was retained, and shows no anomalous outbound transfer, that is a substantive finding. Where the organization had no egress monitoring, or the logs rolled over before anyone looked, the absence of evidence is a gap in the record rather than a finding about the world.
Both sides overreach here, in opposite directions and with equal regularity. The defense characterises a logging gap as proof no data left. The plaintiff characterises the same gap as grounds for assuming everything was taken. Neither is supportable, and an independent analysis should say which of the two situations the evidence actually describes before anyone argues about what follows.
Why does the exposure-versus-misuse distinction matter legally?
Because in federal court a plaintiff must show a concrete injury, and the Supreme Court’s decision in TransUnion LLC v. Ramirez (2021) made clear that a bare statutory violation or a risk of future harm does not automatically supply one for damages purposes. Applied to data breaches, that pushes courts to ask what actually happened to the plaintiff rather than what might happen — with actual identity theft or fraudulent charges sitting very differently from a notification letter and a period of anxiety.
The picture below that is genuinely unsettled and varies between circuits, particularly on how much weight an elevated risk of future misuse carries and on whether mitigation costs count. State courts and state statutes add further variation, and some statutory schemes provide for recovery on terms of their own. What is consistent is that where a case sits on the ladder from accessible to misused materially affects its posture — which is why the technical question is worth answering precisely rather than rhetorically. How that translates into exposure is a question for counsel on the specific facts.
Does notifying individuals concede that the data was misused?
No, and the two operate on different tests. Breach notification obligations are generally triggered by unauthorised acquisition of, or access to, defined categories of personal information, often with a risk-of-harm assessment attached and a short statutory clock. Many organizations notify on a precautionary basis where the evidence is ambiguous, which is frequently both the right call and the one regulators expect.
That decision does not establish the elements of a civil claim, and treating a notification letter as an admission misreads what the letter is for. It is nonetheless true that notification language gets quoted back, so it is worth writing precisely: describing what the evidence shows and what it does not, rather than adopting broader characterisations for the sake of caution. The Institute assesses what the technical record supports; whether and how to notify is counsel’s decision.