The usual suspects, in checking order: a site change that broke things (redesigns that changed URLs without redirects are the classic self-inflicted wound), a Google core update (check SEO-news sources for the date), a technical accident (noindex left on, robots.txt blocking, expired domain/SSL), or competitors simply improving.
Change itself doesn't hurt; LOSING things does. A redesign that keeps URLs (or 301-redirects every old one), keeps content, and improves speed usually gains. One that 'starts fresh' quietly torches years of accumulated credit.
Diagnosis kit: Search Console (coverage errors and which queries dropped), a crawl of your top pages for noindex/redirect mistakes, and the calendar of what changed the week the drop started. Sudden and site-wide = usually technical; slow and partial = usually competitive.