Which scenario illustrates a security incident that is not a data breach?

• A. A malware infection that does not exfiltrate data.
• B. Unauthorized data exfiltration.
• C. Routine maintenance.
• D. A phishing attempt.

Answer: (A)

Distinguishing between a security incident and a data breach is the key idea. A security incident is any event that threatens information security—like malware present on a system or an attempted intrusion. A data breach, on the other hand, means that data was accessed or disclosed outside the organization, typically involving data exfiltration or exposure.

A malware infection that does not exfiltrate data fits as a security incident because malware is now on systems and could cause harm or give an attacker a foothold, but there’s no evidence that any data was accessed or sent out. Since no data left the network, it doesn’t meet the threshold of a data breach.

The other scenarios either involve data leaving the organization (unauthorized data exfiltration), which is a breach, or describe events that aren’t clearly incidents on their own (a routine maintenance window is normal operations, and a phishing attempt is a threat actor’s tactic that may or may not result in a breach). So the malware case is the clearest example of an incident that isn’t a data breach.