What is data exfiltration?

Data exfiltration is the unauthorized copying or transfer of data from an organization's systems or storage to a destination an attacker controls. The original usually stays in place, so nothing looks missing, and restoring from backup does not undo it, because the copy remains in the attacker's hands.

Which egress channels carry stolen data?

  • Cloud storage and file-sharing services: uploads to popular services blend in with normal business traffic.
  • Encrypted web traffic to servers the attacker runs, which hides the content from network inspection.
  • File transfer and sync tools: legitimate utilities installed or reused by the attacker.
  • Remote access tools already planted during the intrusion.
  • Covert channels: data hidden inside traffic that is normally allowed out, such as DNS lookups.

Before sending, attackers usually stage the data: they gather files on one machine, pack them into compressed archives and split transfers into smaller pieces, often at night or on weekends. Staging is often the most visible step, for example a server that rarely sends much suddenly building gigabytes of archives.

How do unauthorized API reads expose storage?

Object storage and cloud services serve data through APIs. With a stolen access key, an attacker can list buckets and read objects directly over the network without touching any server, and to the storage the requests look like those of an authorized application. Backup repositories are an attractive target because they hold an organized copy of almost everything, and the storage key that backup software uses often sits on the backup server, where credential theft can expose the whole history.

An immutable backup does not change this, since a locked object can still be read. Exposure is limited by separate credentials for reading backups, least-privilege keys, backup encryption with keys held elsewhere, and alerts on read volume far above normal for a key, on listings of buckets the key never used, and on requests from unfamiliar addresses. Those alerts are part of breach detection.

Why restoring does not reverse the theft

Theft is now part of most extortion attacks: in Coveware's Q2 2026 quarterly report, exfiltration appeared in 76% of the cyber extortion cases it handled. Restoring from backup repairs deleted or encrypted data, but the copy on the attacker's server is still a data breach, and the threat to publish it is the basis of double extortion ransomware.

Frequently asked questions

Is data exfiltration the same as a data breach?

No. Exfiltration is the act of copying data out, and a data breach is the incident that results.

Do immutable backups prevent data exfiltration?

No. Immutability stops deletion and changes, but a locked backup can still be read and copied.

Why do attackers steal data before encrypting?

So they can threaten to publish it even if the victim restores from backup, which is the basis of double extortion.