Data exfiltration

What it means

Data exfiltration is the unauthorised copying of data out of your systems to a place the attacker controls. It is usually the last step of an intrusion: get in, find what is valuable, collect it, and move it out. MITRE ATT&CK lists exfiltration as its own stage, after collection.

The idea that makes it click: stealing data is only as hard as getting it past your boundaries. An attacker with access may send it over a normal web connection, tuck it into DNS requests, upload it to a cloud storage account or pull it out slowly through your own API. It often looks like ordinary traffic.

Why it matters

Exfiltration is the moment an incident becomes a data breach. Before it, the attacker has access. After it, your customers' records exist somewhere you cannot reach or delete. That triggers duties to notify regulators and customers, and the harm cannot be undone.

Detection is often late because the copying looks legitimate. A single account pulling thousands of records through an API, or an export feature used at three in the morning, may not stand out unless you are watching for it. Short log retention also removes the evidence of what left.

How it shows up

Routes include a large export or report endpoint, an API that returns whole collections, cloud storage copied to an outside account, email forwarding rules, removable media and tunnelling over DNS or other allowed protocols. In an application, a flaw such as BOLA or a missing limit lets one account page through everyone's data, which counts as exfiltration through your front door.

Reduce the room to move: limit what each account can read, set rate limits and size caps on exports, restrict outbound traffic with egress filtering, alert on unusual volume, and use data loss prevention on sensitive stores. Test the app for ways one account can read in bulk.