What is Data Exfiltration?
Data Exfiltration is the unauthorized transfer of data from an organization's systems to an external destination controlled by an attacker or malicious insider. It is the end goal of most data breaches and can occur over network connections, removable media, email, cloud uploads, or even covert channels.
What it is
Data exfiltration happens when data leaves an organization without authorization. The data can be customer records, source code, credentials, financial data, or intellectual property. The transfer can be:
- Network-based: Sending data over HTTP, DNS, FTP, or encrypted tunnels to an attacker-controlled server.
- Endpoint-based: Copying files to USB drives, personal cloud storage, or printing documents.
- Application-based: Pasting credentials into AI tools, uploading files to personal email, or using browser extensions to scrape data.
- Insider-driven: A departing employee emailing themselves files before leaving.
Exfiltration is usually the final stage of an attack chain. Attackers first gain access, move laterally, find valuable data, and then extract it. The window between initial access and exfiltration can be hours or months.
Why it matters
A successful exfiltration event can trigger regulatory penalties under GDPR, HIPAA, PCI-DSS, and similar frameworks. It can expose customer data, trade secrets, or authentication material that enables further attacks. The reputational and legal costs often exceed the direct cost of the breach itself.
How tools address it
No single product stops every exfiltration path. Teams typically layer several controls:
- Data Loss Prevention (DLP) tools inspect content in motion across endpoints, networks, and cloud services. They can block or alert on transfers that match sensitive data patterns.
- Data Security Posture Management (DSPM) tools find where sensitive data lives so teams know what is at risk before exfiltration occurs.