Data exfiltration is the unauthorised transfer of data out of your organisation — customer records, pricing, source code, payroll files, emails — by an outsider or an insider. It is the mechanism behind most serious breaches: a ransomware crew copies your data before encrypting it, an infostealer quietly exports browser passwords, a departing employee emails a customer list to themselves. Stopping it is about controlling the exits: email, cloud sync, USB, web upload and the accounts that move data.
TL;DR
- Data exfiltration is unauthorised movement of data out of your organisation, by attacker or insider.
- It powers double-extortion ransomware, credential theft and departing-employee theft alike.
- Common exits: email, personal cloud storage, USB, web upload, and the attacker's own command channel.
- Detection combines egress monitoring with human reporting — a person noticing the odd export is often the first alert.
- Controls: least privilege, MFA, egress filtering, data classification, and staff who report odd behaviour.
What is data exfiltration?
Any transfer of data that leaves the boundary of what the organisation authorised. It is a mechanism, not a single attack: the same exfiltration pattern shows up in externally driven breaches, insider misuse and everything between. Australian breaches are measured in the hundreds per half-year: the Office of the Australian Information Commissioner publishes the notifiable data breaches report each half-year, with malicious or criminal attacks the leading cause — exfiltration is how those attacks realise their value.
Exfiltration is also what turns an intrusion into leverage. Ransomware groups exfiltrate first, then encrypt, then threaten to publish the stolen data if the ransom is not paid — double extortion. Without the copied data, encryption alone is a recoverable nuisance if backups are good.
How data leaves
- Email. Attachments, mailbox forwarding rules, or bulk exports mailed to personal accounts.
- Cloud storage and sync. Personal Dropbox, Google Drive or WeTransfer accounts used as a private exit lane.
- USB and removable media. Physical export of files that never touch the network.
- Web upload. File-sharing sites, code repositories, AI chatbots pasted with sensitive documents.
- Malware command channels. Infostealers send stolen passwords, cookies and session tokens straight to the attacker's servers.
- Print and screenshots. The low-tech exits nobody monitors.
Who takes the data
- External attackers. After phishing or an exploited server, they copy what is valuable before the damage becomes visible.
- Compromised accounts. The attacker works from inside a real mailbox, where activity looks legitimate.
- Departing employees. Customer lists, price books and project files copied “to take with them” — see the offboarding guide.
- Negligent staff. Not theft, just bad habits — auto-sync to personal cloud, email home “to work on the weekend”. The outcome for the data is the same.
Warning signs
- Bulk downloads or exports outside a person's normal work pattern.
- Access at unusual hours, or from unusual locations.
- New mailbox forwarding rules nobody set up.
- Personal cloud-sync tools appearing on work machines.
- Unknown devices or sessions on shared drives and cloud admin panels.
None of these alone proves theft — patterns do. A single odd export from a busy salesperson is usually work; the same export from a resigned employee is a case file.
How to stop data exfiltration
- Least privilege. Most exfiltrated data was accessible to people who never needed it. Cut access to what each role requires.
- Multi-factor authentication everywhere. The stolen-credential path — how most external exfiltration begins — closes here.
- Egress monitoring. Watch bulk email, cloud upload and download volumes; alert on the patterns above. Logs nobody reads are decoration.
- Classify and restrict. Label what is sensitive (customer lists, pricing, source code) and apply tighter rules on where it can go.
- Restrict USB and personal cloud tools on machines that handle sensitive data.
- Run joiner-mover-leaver reviews. Access gets checked the day someone leaves, not the week after.
- Train the human layer. Cyber Aware's security awareness training makes “data going where it shouldn't” reportable, and human risk reporting shows per person whether reporting and click behaviour is improving — the two behaviours that catch exfiltration early.
What to do when exfiltration is suspected
- Contain: disable the account or device, revoke sessions, block the exit channel.
- Preserve: keep logs and the evidence trail before resetting anything.
- Assess: what data, whose data, how much — and whether the Privacy Act's Notifiable Data Breaches scheme applies.
- Report: ReportCyber, and notify affected individuals if required.
- Close the gap: whichever control failed — access review, egress monitoring, training — gets fixed before the next attempt.
FAQ
What is data exfiltration in simple terms? Data leaving your organisation without authorisation — through malware, a stolen account, or an employee emailing files to themselves. It is the step that turns a break-in into a breach.
Is data exfiltration the same as a data breach? Exfiltration is the transfer of data out; a breach is the broader incident of unauthorised access. Exfiltration is usually the proof that a breach actually took something.
How is data exfiltrated in ransomware attacks? Modern crews copy the valuable data first, encrypt second, then threaten publication for double extortion. Detecting the quiet copy before the encryption gives you your only early warning.
Can departing employees take data? Yes, and it is one of the most common insider patterns: customer lists and files copied in the notice period. Access review at offboarding plus egress monitoring on departing accounts closes most of it.
What tool stops data exfiltration? No single tool. Least privilege, MFA, egress monitoring, USB and cloud restrictions, and trained staff who report odd data movement together close the main exits.
One last thing
Open your email admin panel this week and check one thing: how many mailbox forwarding rules point to outside addresses? A single hidden forwarding rule is the quietest exfiltration channel there is, and most small businesses have never audited it.