Unauthorized Access to Customer Data

A subject accesses, views, searches, queries, or retrieves customer data without a legitimate business purpose or authorization to do so. The subject may possess valid technical access to the relevant system or dataset but uses that access outside the requirements of their role, assigned duties, customer relationships, cases, transactions, or other approved activity.

Customer data may include personally identifiable information, account details, transactional records, financial information, support interactions, communications, location information, or other information relating to customers, clients, patients, subscribers, or account holders. The infringement occurs through the unauthorized access itself and does not require the information to be subsequently disclosed, modified, copied, or exfiltrated.