In one sentence: Data exfiltration is the theft of information out of your business, where an attacker copies your files, emails or databases to somewhere they control.

What it is

MITRE ATT&CK, the public catalogue of attacker behaviour, defines exfiltration as the stage where the adversary is trying to steal data from your network. It consists of techniques for getting data out.

Exfiltration is often paired with ransomware. Attackers steal first, then lock files, then threaten to publish the stolen copy. That pairing is called double extortion.

How it works

1. Get in and collect. The attacker gains access, finds valuable files, and gathers them.
2. Package. MITRE says adversaries often package data to avoid detection while removing it, which can include compression and encryption. They may also send it in fixed-size chunks so size alerts do not fire.
3. Choose a route out. The data may go over the attacker’s existing control channel, or over a different protocol. MITRE lists FTP, SMTP, HTTP/S, DNS and SMB as examples.
4. Use a web service. Data can go to a cloud storage service. MITRE notes this can give cover when machines already talk to that service.
5. Use your own cloud. Many cloud and software-as-a-service platforms allow direct download of files, emails and source code through a web console or API, so a stolen account can be enough.

Who it affects and how badly

Any organisation that holds data someone else would value.

• Sole trader to 10 staff: client details and bank information in a mailbox. Worst case: fraud against your clients and a damaged reputation.
• 10 to 50 staff: accountancy and legal practices, estate agents and recruiters hold identity documents and financial data.
• 50 to 250 staff: manufacturers lose designs and tender prices. Care providers and schools lose sensitive records.
• Regulated businesses: fintech, insurance and healthcare face a regulator. In the UK, the ICO fined Capita £14m (£8m plus £6m across two companies) after 6.6 million people’s information was stolen.

Real examples

• Capita, March 2023. The ICO says the attack began when a malicious file was unintentionally downloaded onto an employee device on 22 March 2023. A high-priority security alert was raised within 10 minutes, but the device was not quarantined for 58 hours, during which the attacker could exploit Capita’s systems. The personal information of 6.6 million people was stolen. The ICO fined Capita plc £8m and Capita Pension Solutions Limited £6m. Capita admitted liability and did not appeal.

How to detect it

• Alert on unusual outbound volume, and on office apps or scripts suddenly making outbound web connections. MITRE’s detection notes describe high outbound-to-inbound data ratios and file archiving followed by encrypted uploads.
• In Microsoft 365, Google Workspace or Box, watch the audit log for unusual numbers of upload, create or copy actions from one account (MITRE).
• Act on the first alert. The Capita case shows that detection without containment is not enough.
• Treat any account that suddenly downloads far more than usual as compromised until proven otherwise.

How to fix or prevent it

1. Stop attackers getting in: patch, use multi-factor authentication, and train staff.
2. Limit what any one account can reach, so a single stolen account cannot copy everything.
3. Use data loss prevention (DLP) to detect and block sensitive data uploaded via browsers (MITRE mitigation M1057).
4. Use web proxies to enforce a policy on which external services may be used (MITRE M1021).
5. Filter network traffic and restrict cloud access to expected IP ranges where you can (MITRE M1037).
6. Use network intrusion detection and prevention to spot known attacker infrastructure (MITRE M1031).
7. Decide in advance who can isolate a device, and give them authority to do it at once.

Related terms

• double extortion
• ransomware
• indicators of compromise
• infostealer malware
• personal data breach ico 72 hour rule
• uk gdpr

Frequently asked questions

What is the difference between a data breach and data exfiltration?
Exfiltration is one way a breach happens: the copying of data out of your environment. A breach can also involve data being lost or exposed in other ways.

Can data be stolen over normal web traffic?
Yes. MITRE notes data can be sent to cloud storage services or over common protocols such as HTTP/S, which can blend with normal activity.

How quickly should a suspect device be isolated?
As fast as possible. The ICO found Capita did not quarantine the device for 58 hours after a high-priority alert.

Sources

• MITRE ATT&CK Exfiltration tactic TA0010: https://attack.mitre.org/tactics/TA0010/
• MITRE ATT&CK T1048 Exfiltration Over Alternative Protocol: https://attack.mitre.org/techniques/T1048/
• MITRE ATT&CK T1567 Exfiltration Over Web Service: https://attack.mitre.org/techniques/T1567/
• ICO: Capita fined £14m for data breach affecting over 6m people: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/10/capita-fined-14m-for-data-breach-affecting-over-6m-people/

How Wolfcore helps

Wolfcore’s ransomware readiness assessment shows how far an attacker would get and what you would lose, and our SOC monitoring keeps watch after the test. See Wolfcore pricing.