Data Exfiltration Definition
Data exfiltration is the unauthorized transfer of data out of an organization, whether it's copied, moved, or sent to a location the attacker or insider controls. The word exfiltrate originally described moving people out of hostile territory. In cybersecurity, it means getting data out of a network without permission.
Exfiltration can be carried out by external attackers, who steal data after breaching a network, or by insiders, who take data on purpose or leak it by accident. It's usually the goal of an attack rather than the start of one. Ransomware groups now routinely steal data before encrypting systems, so they can threaten to publish it if the victim doesn't pay. Because the data often leaves through normal channels like email, cloud storage, or encrypted web traffic, exfiltration can be hard to tell apart from legitimate activity.
How does data exfiltration happen?
Attackers and insiders use many channels to move data out. Email and personal accounts are the most common: sending files to a personal address or uploading them to personal cloud storage. Removable media like USB drives lets someone copy data straight off a device. Cloud apps and file-sharing services can be abused to sync or share sensitive files outside the organization. More advanced attackers use encrypted HTTPS traffic or DNS exfiltration, which hides data inside DNS queries that many networks don't inspect. In ransomware attacks, data is often compressed, encrypted, and sent to attacker servers in small pieces to avoid triggering alerts.
How do you detect data exfiltration?
Detection focuses on unusual data movement. Warning signs include large or unexpected outbound transfers, uploads to unfamiliar cloud services or personal accounts, and access at odd hours or from unusual locations. Other signs include a user suddenly downloading far more files than normal and unusual DNS activity, such as very long or high-volume queries to one domain. Security teams catch these signals with data loss prevention (DLP), network traffic analysis, user and entity behavior analytics (UEBA), and endpoint monitoring. Knowing which data is sensitive makes detection much more accurate, since an alert on a confidential file matters more than one on a public document.
How can organizations prevent data exfiltration?
Prevention starts with knowing what you're protecting. Data classification identifies sensitive information and labels it, so security controls can treat it differently from routine data. Data loss prevention (DLP) then enforces policy across email, web, cloud, and endpoints, blocking or encrypting sensitive data before it leaves. Least-privilege access limits how much data any single account can reach, which reduces the damage from a compromised login or a malicious insider. Organizations should also restrict or monitor USB devices, filter DNS traffic, and use multi-factor authentication to stop attackers from getting in. Solutions like Fortra's DLP and Data Classification work together so sensitive data is identified, labeled, and stopped at the point of exit.