Data Exfiltration

Data exfiltration is the unauthorized movement of data from inside an organization to a destination it controls no longer — an attacker's server, a personal cloud account, a USB stick walking out the door. It is the step that turns an intrusion into a data breach: access alone can be revoked, but data that has left is gone for good, which is why exfiltration is the pivotal moment in ransomware double-extortion, industrial espionage, and insider theft alike.

How it works

External attackers typically exfiltrate over channels that blend into normal traffic: HTTPS uploads to cloud storage, DNS tunneling, or the same remote-access tools IT already uses. Infostealer malware automates the pattern at scale, harvesting credentials and session cookies within minutes of infection. Insiders need less ingenuity — they already have access. A departing employee syncs a customer list to a personal drive, forwards project files to a private email address, or photographs a screen. The negligent version is quieter still: files pushed to an unsanctioned AI tool or file-sharing app simply to work faster, with no intent to harm. In the 2026 Ponemon/DTEX insider-risk data, careless employees account for 53% of insider incidents — making everyday exfiltration a habit problem as much as a security problem.

How to defend against it

Start by knowing where sensitive data lives and who can reach it, then cut standing access with least privilege so there is less to take. Data loss prevention controls on email, cloud sync, endpoints, and removable media catch sensitive content in motion, while behavior analytics flag the signatures of theft — mass downloads, off-hours access, archives staged for upload. Watch the leaver window closely: resignations and terminations concentrate insider exfiltration. And because the careless majority responds to habits rather than warnings, pair controls with training and measurement of risky behavior over time — the approach behind a human risk score — so the people most likely to leak data get support before it happens. A deeper playbook is in our guide to insider threat management.