Incidents involving unauthorized access, disclosure, loss, or misuse of sensitive data, often leading to regulatory, litigation, or remediation obligations.