What Is Data Exfiltration? Methods and Defense

An attacker who has spent three weeks inside a network does not declare victory until the data leaves. The intrusion, the stolen credentials, the lateral movement across hosts, all of it is setup. The payoff is the moment a few gigabytes of customer records, source code, or design files cross the perimeter and land on infrastructure the attacker controls. That moment is data exfiltration, and it is the step the whole operation was built around.

It is also the step defenders most often miss. Exfiltration rarely looks like an alarm going off. It looks like an HTTPS upload to a cloud storage service, a slow trickle of DNS queries, or an employee copying files to a USB drive on their last day. The data theft hides inside traffic that is indistinguishable from the legitimate kind, which is exactly why it works.

This guide defines data exfiltration, walks through how it happens and the techniques attackers use, explains why detecting it is so hard, and lays out the controls that actually reduce the risk. The focus is practical: what the activity looks like on the wire and the host, and where a defender can catch it.

What is data exfiltration?

Data exfiltration is the unauthorized transfer of data from a device or network to a location the owner does not control. It is the theft step of an attack: taking data that should stay inside and moving it out, usually to attacker-controlled infrastructure. The term covers both deliberate theft by an external attacker and unauthorized removal by an insider.

The defining trait is the direction and the authorization. Data moves outbound, to somewhere it should not go, controlled by someone who should not have it. That distinguishes exfiltration from a data breach, which is the broader event of unauthorized access to protected data. Exfiltration is the specific act of getting that data out. A breach can occur without exfiltration if an attacker only views records, and exfiltration is the action that most often turns access into loss.

To stay hidden, attackers package data before it leaves. They compress it to shrink the volume and encrypt it so that any system inspecting the traffic sees ciphertext, not the records inside. The goal is to make the transfer look like ordinary encrypted traffic, of which every network has an enormous amount.

In the MITRE ATT&CK framework, this is the Exfiltration tactic, TA0010, defined plainly as "the adversary is trying to steal data." It sits near the end of an intrusion, after the attacker has found and collected what they want, and the techniques under it describe the different channels they use to ship it out.

How does data exfiltration occur?

Exfiltration is almost never the first thing that happens. It is the last stage of a longer sequence, and understanding that sequence is what lets a defender catch it before the data is gone.

A typical path runs like this. An attacker gains an initial foothold, often through phishing that harvests credentials or drops malware. They establish persistence and a command and control channel back to their own infrastructure. They perform lateral movement to reach the systems that hold the data worth taking, escalating privileges along the way. They locate and stage the target data, often compressing and encrypting it into an archive. Then, and only then, they exfiltrate it.

That ordering is the defender's advantage. Exfiltration is the final move, so every earlier stage is a chance to detect and stop the intrusion before any data leaves. The attacker has to get all the way to the end; the defender only has to catch one step.

Exfiltration is not always an external attacker. An insider with legitimate access can carry data out without breaking anything, which is harder to spot because no system was compromised. The two broad sources:

• External attackers. They break in, move toward the data, and ship it to their own servers or cloud storage. The transfer is the goal of the whole operation.
• Insiders. A malicious employee or contractor with valid credentials downloads sensitive data to a personal device, a thumb drive, or personal cloud storage. Negligent insiders cause the same outcome by accident, moving data to unprotected personal devices or misconfigured shares.

Common data exfiltration techniques

Attackers choose a channel that blends in with what the network already does. The best exfiltration technique is the one that looks like normal business traffic, because traffic that looks normal does not get inspected. These map to techniques under the ATT&CK Exfiltration tactic.

• Exfiltration over the command and control channel (T1041). The simplest method: send the data back through the same channel already used to control the compromised host. The traffic is already established and often encrypted, so the data rides out on a connection the defender has already accepted.
• Exfiltration over a web service (T1567). Upload the data to a legitimate cloud service, such as a file-sharing site, code repository, or storage bucket. To a firewall, this is an employee using an approved SaaS tool. The destination is trusted, so the upload draws no attention.
• DNS tunneling. Encode stolen data inside DNS queries. DNS is rarely blocked and often only lightly inspected, so an attacker can leak data in small chunks across many lookups. It is slow, but it slips past controls that watch HTTP and ignore DNS.
• Scheduled transfer (T1029). Time the transfer to blend with normal traffic patterns, such as during business hours or in small amounts over a long period, so the volume never spikes enough to trigger a threshold alert.
• Physical media (T1052). Copy data to a USB drive or external disk and carry it out. No network detection sees this at all. It is the classic insider method and the reason endpoint and removable-media controls matter as much as network monitoring.
• Encrypted and compressed transfer. Across most of the above, attackers compress and encrypt the data first. Compression shrinks the footprint; encryption defeats content inspection. A DLP tool that reads file contents sees only ciphertext.

The common thread is camouflage. Every technique is chosen to make theft look like routine activity, which is why volume, destination, and behavior matter more than the content of any single packet.

Why detecting data exfiltration is hard

Detecting exfiltration is hard precisely because the technique presents as normal network traffic. An encrypted upload to a cloud service is, byte for byte, what legitimate work looks like. There is no signature for "this HTTPS session is theft," because the malicious session and the benign one are built from the same protocol.

Three properties make it slippery:

• It hides in encryption. Most exfiltration is encrypted, by the attacker or by the transport itself. Content inspection sees ciphertext, so detection cannot rely on reading the data. It has to rely on behavior around the transfer.
• It uses trusted destinations. Uploading to a well-known cloud provider routes the data through a destination the firewall already allows. Blocking it outright would block legitimate business, so the destination alone is not a reliable signal.
• It can be slow and low. DNS tunneling and scheduled transfers move data in small pieces over time, staying under any single volume threshold. The total leaked can be large while no individual event looks abnormal.

So detection shifts from content to context. The signals that work are behavioral: an unusual volume of outbound data from a host that normally sends little, a connection to a destination the organization has never communicated with, a spike in DNS query volume or oddly long query names, data transfers at hours when the user is not working, or an account suddenly accessing files far outside its normal pattern. None of these is proof on its own. Together, and against a baseline of what normal looks like, they are what surfaces exfiltration in progress.

This is why dwell time stays high. IBM's 2025 Cost of a Data Breach report found organizations took an average of 241 days to identify and contain a breach. A competent attacker exfiltrating over encrypted, trusted channels can operate inside that window without ever tripping a content-based alert.

How to prevent data exfiltration

No single control stops exfiltration, because it can happen over the network, through the endpoint, or out the door on a USB drive. The defense is layered: shrink what an attacker can reach, watch how data moves, and catch the transfer when it happens. The strongest position combines prevention with the behavioral detection above.

Two principles tie the table together. First, defend the whole chain, not just the exit. Because exfiltration is the last stage, the controls that catch lateral movement, privilege escalation, and command and control all prevent the theft before it happens. Stopping the intrusion early is cheaper than catching the transfer late.

Second, data loss prevention is the control aimed squarely at the exit, but it has a known limit: it inspects content, and content that is encrypted by the attacker defeats it. DLP is necessary and not sufficient. It pairs with behavioral network and endpoint monitoring, which watches how data moves rather than what is inside it, and with least privilege and egress filtering that reduce what can be reached and where it can go in the first place.

For the insider path specifically, the controls are about access, not malware. Least privilege limits what an insider can touch, removable-media policy limits how they can copy it, monitoring flags abnormal access, and prompt offboarding closes the window around the moment people are most likely to take data: when they are leaving.

Frequently asked questions

What is data exfiltration in cybersecurity?

Data exfiltration is the unauthorized transfer of data from a device or network to a location the owner does not control, typically attacker-controlled infrastructure. It is the theft stage of an attack, the point where access to data becomes actual loss of data. It covers both external attackers shipping stolen data out and insiders removing data they should not take.

What is the difference between a data breach and data exfiltration?

A data breach is the broader event of unauthorized access to protected data. Data exfiltration is the specific act of moving that data out of the environment. A breach can happen without exfiltration, for example if an attacker only views records, and exfiltration is the action that most often turns a breach into measurable data loss. In short, the breach is the access; the exfiltration is the removal.

What are common data exfiltration techniques?

Common techniques include sending data back through an existing command and control channel, uploading it to a legitimate cloud or web service, tunneling it inside DNS queries, scheduling transfers to blend with normal traffic, and copying data to USB or external drives. Most network methods involve compressing and encrypting the data first so that content inspection cannot read it. Each technique is chosen to make theft look like ordinary traffic.

Why is data exfiltration hard to detect?

Because it presents as normal network traffic. Most exfiltration is encrypted, so inspecting content reveals only ciphertext, and it often uses trusted destinations like major cloud providers that firewalls already allow. Slow methods such as DNS tunneling stay under volume thresholds. Detection therefore relies on behavioral signals, unusual outbound volume, new destinations, off-hours transfers, abnormal DNS patterns, measured against a baseline of normal activity.

How do you prevent data exfiltration?

Use layered controls: data loss prevention to inspect and block sensitive data leaving, least privilege to limit what any account can reach, network and DNS monitoring with egress filtering to catch and constrain outbound channels, endpoint and removable-media controls against USB copying, and encryption at rest so stolen data is useless without keys. Because exfiltration is the last stage of an attack, detecting lateral movement and command and control earlier stops the theft before it happens.

Can insiders cause data exfiltration?

Yes. An insider with valid credentials can download sensitive data to a personal device, thumb drive, or personal cloud account without compromising any system, which makes it harder to detect than an external attack. Negligent insiders cause the same loss by accident through unsafe data handling. The defenses are access-focused: least privilege, removable-media controls, monitoring for abnormal access, and prompt revocation of access when employees leave.

The bottom line

Data exfiltration is the unauthorized transfer of data out of a network, and it is the step an entire intrusion is built to reach. Attackers compress and encrypt the data, then ship it over channels chosen to look ordinary: the existing command and control connection, an upload to a trusted cloud service, a slow trickle of DNS queries, or a USB drive carried out the door. That camouflage is what makes it so hard to catch, because the malicious transfer is built from the same protocols as legitimate work.

The defense follows from how the attack works. Detection has to be behavioral, watching volume, destinations, timing, and access patterns against a baseline rather than reading content that is encrypted anyway. Prevention has to be layered, with DLP at the exit, least privilege and egress filtering to limit reach and routes, endpoint controls for the physical path, and encryption to blunt the impact. And because exfiltration is the last stage, the cheapest place to stop it is earlier in the chain, by catching the lateral movement and command and control that always come first. Treat the transfer as the only thing to watch and you will see it after the data is already gone.