(I work at 18F but am speaking personally). I would point out this FedScoop article that discusses how the OIG defines &quot;data breach:&quot; <a href="http:&#x2F;&#x2F;fedscoop.com&#x2F;18f-slack-gsa-ig-oauth-20" rel="nofollow">http:&#x2F;&#x2F;fedscoop.com&#x2F;18f-slack-gsa-ig-oauth-20</a><p>&gt; situations where persons other than authorized users with an authorized purpose have access <i>or potential access to PII</i>