dataexfiltration

Data exfiltration is the unauthorized transfer of data from a protected environment to an external destination. It can involve any sensitive data: personal data, financial information, intellectual property, or strategic data. It is a common objective in data breach campaigns and can result from external attacks or insider threats.

Actors and motives: Threat actors range from cybercriminals seeking financial gain to state-sponsored groups and insider threats. Motives include monetization, competition, espionage, or political objectives. Exfiltration may exploit weak accounts, phishing, compromised devices, misconfigurations, or vulnerable supply chains.

Methods (high-level): Exfiltration can occur via network channels such as outbound data transfers over legitimate protocols or encrypted connections; through removable media; via cloud storage or backups; or by concealing data within legitimate traffic. Covert channels and steganography or abuse of authorized services may be used to evade detection, but we avoid giving actionable details.

Detection and defense: Indicators include unusual egress traffic, large transfers to unfamiliar destinations, odd DNS queries, or anomalous access patterns. Defenses include data classification and least-privilege access, encryption in transit and at rest, data loss prevention systems, network segmentation, endpoint protection, user and entity behavior analytics, and robust incident response.

Legal and regulatory context: Data exfiltration constitutes unauthorized access and transfer and is illegal in many jurisdictions. It can trigger breach notification requirements under data protection laws (for example GDPR, HIPAA) and may lead to civil or criminal penalties. Organizations should implement governance and auditing to mitigate risk.