PII covers information that identifies people, making its collection, storage, and disclosure central to privacy protection and breach response.
Search across headline titles and summaries.
Background for this topic.
PII (personally identifiable information) is information that identifies a person directly or can do so when combined with other data. Direct identifiers include names, government identification numbers, passport details, and email addresses; indirect identifiers can include birth dates, precise location, or unique account attributes. The term is used broadly in security, but its legal scope varies: laws and regulations may use different definitions, such as “personal data” under the GDPR or protected health information under HIPAA.
PII is a high-value target because unauthorized access or disclosure can enable identity fraud, targeted phishing, or privacy harm. It may be exposed through compromised applications, cloud storage, logs, endpoints, or third parties. Practitioners should inventory and classify it, collect and retain only what is needed, restrict access, and protect it with encryption or tokenization where appropriate. Monitoring and tested procedures for investigating exposure are important, while retention, deletion, and notification duties depend on the applicable jurisdiction and sector.
Weekly headline count for the current query.
Lloyds app glitch exposed up to 447,936 customers’ transactions and personal data during update
The UK’s ICO has fined Reddit over £14m for failing to use children’s personal information lawfully
Phishing attack mimicking Bitpanda targets users, harvesting credentials and personal information
California privacy regulator, the CPPA, is cracking down on data brokers trading personal data without authorization
Nissan has revealed that over 20,000 customers have had personal information compromised in a third-party data breach
LKQ confirmed that over 9000 individuals saw their personal data compromised because of the breach
The personal data of over two million amateur football players registered in France could be exposed
Almost two million people may have seen their personal data exposed following a large-scale cyberattack that hit Asahi in September 2025
DoorDash has confirmed an October 2025 data breach that exposed customer names, phone numbers, addresses and email details
The Dutch Data Protection Authority issued Experian a €2.7m for GDPR violations including excessive collection of personal data
The US lending platform said early investigations found no evidence of unauthorized account access or fund theft
Stellantis confirmed that customers’ personal information was potentially exposed
Compromised data includes personal data such as patients’ full names, ages, phone numbers and email addresses
A cyber-attack on Allianz Life, linked to the ShinyHunters group, has exposed the personal information of 1.1 million customers
The Canadian Investment Regulatory Organization (CIRO) said it will work to identify the personal information breached and notify those affected
The personal data of almost 145,000 people who were registered in Manpower’s systems was compromised
Bouygues Telecom revealed the attackers stole personal data of 6.4 million customers, including contact details, contractual data and international bank account numbers
A large-scale malware campaign known as SarangTrap has been observed using fake dating apps to steal personal data, targeting South Korean users
A data breach at Episource has exposed the personal information of 5.4 million individuals after attackers accessed systems for 10 days
Louis Vuitton’s UK business has notified customers of a personal data breach