If you lose someone’s data because of a configuration blunder that lets crooks in without any actual hacking… is that a “breach” or not?

If you lose someone’s data because of a configuration blunder that lets crooks in without any actual hacking… is that a “breach” or not?