Data Exfiltration
The unauthorized transfer, disclosure, or removal of data from a system, network, application, or controlled environment.
Exfiltration can expose personal data, intellectual property, credentials, regulated information, and commercial strategy, leading to operational disruption, notification duties, financial loss, and reputational damage.
An attacker compromises a SaaS administrator account and exports customer records to external storage. Identity telemetry, unusual-download alerts, and egress controls detect and contain the activity.
Data exfiltration is an outcome, not a single attack technique. Legitimate transfers can look similar, encrypted traffic reduces content visibility, and prevention controls can disrupt normal work if classification and policies are poorly designed.
Exfiltration may occur through network channels, cloud services, removable media, compromised accounts, malicious insiders, covert protocols, or authorized tools used outside policy. It can be rapid or deliberately low-volume to evade detection. Controls include data classification, least privilege, egress filtering, data loss prevention, behavioral monitoring, encryption, and incident response.
AI Governance, Data Engineering
MITRE ATT&CK — Exfiltration — https://attack.mitre.org/tactics/TA0010/; NIST — Cybersecurity Framework — https://www.nist.gov/cyberframework