Data Exfiltration.

What is data exfiltration?

NIST defines exfiltration as the unauthorized transfer of information from a system. In plain words, someone copies or moves data out of a place where it should stay. The word is often used for attacks, where the person doing it is an adversary, meaning the attacker.

How does data exfiltration work?

MITRE ATT&CK is a public catalog of attacker behavior. It lists Exfiltration as a tactic, which means a goal an attacker is working towards. MITRE says the adversary is trying to steal data, and that exfiltration consists of techniques adversaries may use to steal data from your network.

MITRE also describes the usual steps. Once data is collected, adversaries often package it to avoid detection while removing it. This can include compression and encryption. Compression makes files smaller, and encryption scrambles them so they are hard to read in transit. Data is typically sent out over the attacker’s command and control channel, which is the link the attacker uses to direct a compromised system, or over an alternate channel. Attackers may also put size limits on the transmission.

What are common ways data is sent out?

MITRE lists several techniques under the Exfiltration tactic. Their names show the range of routes:

• Automated exfiltration
• Data transfer size limits
• Exfiltration over an alternative protocol
• Exfiltration over a command and control channel
• Exfiltration over another network medium
• Exfiltration over a physical medium
• Exfiltration over a web service
• Scheduled transfer
• Transfer of data to a cloud account

On the web service technique, MITRE says adversaries may use an existing, legitimate external web service to exfiltrate data rather than their primary command and control channel.

What does it look like in simple terms?

This is a simple illustration only. An attacker who has reached a system gathers files, packs them into one archive, and uploads the archive to an outside service. The data leaves the organization without permission.

How can data exfiltration be detected or reduced?

MITRE gives detection ideas for the web service technique. They include watching for processes that normally do not use the network suddenly making outbound HTTPS connections with high outbound-to-inbound data ratios, and spotting an abnormal sequence of file archiving followed by encrypted uploads to external web services. MITRE also suggests monitoring audit logs for an elevated frequency of upload, create or copy operations from compromised accounts.

MITRE names two mitigations for that technique. The first is data loss prevention, which it says can detect and block sensitive data being uploaded to web services via web browsers. The second is restricting web-based content. MITRE says web proxies can enforce an external network communication policy that prevents use of unauthorized external services.

Is data exfiltration the same as a data breach?

Not exactly. Exfiltration describes the act of moving data out. A data breach is the wider term for an incident where data is exposed. You can read more under the related term data breach. Exfiltration is one way data can leave, but the two words are not interchangeable.

Is data exfiltration the same as data theft?

They are close. MITRE describes the Exfiltration tactic as the adversary trying to steal data, so in an attack setting the two ideas overlap. Exfiltration is the more specific word. It points to the step of getting the data out of the network, rather than the whole theft.

Does exfiltration always come from an outside attacker?

The NIST definition does not name who does the transfer. It only says the transfer is unauthorized. The word therefore describes what happened to the data, not who caused it.

In the SingHealth attack the attacker copied the records of almost 1.5 million patients, and in the 2025 Coupang case about 33.7 million customer accounts were exposed.