A blockchain reorganisation can occur when a miner temporarily withholds publishing blocks they have found until they have enough blocks to make the chain they are working on the longest. A miner would need to have a significant percentage of the network’s hash rate for this to occur more than a couple of blocks after one was found. Only a miner with more than 50% of the total hash rate could confidently predict that their hidden chain would eventually be longer than the main chain. This is known as a 51% attack.
As the longest chain is considered the valid blockchain, miners will immediately switch to the new chain, making the blocks found since the split orphaned. Unless a block was withheld with the intention of publishing a longer chain later to accomplish a double spend, it is very likely all the original transactions would be included in the new (or later) blocks.