Skip to content
Cyber Unboxed
Insider Threats

Data Exfiltration: How Data Quietly Walks Out the Door

Data exfiltration, the theft of data out of an organisation, is often the real goal of an attack. Here are the routes it takes.

3 min readIntermediate Sep 1, 2026

Explain Like I'm Not a Hacker

It's the moment a shoplifter has to walk past the till with the goods stuffed under their coat. That walk is when they can still be stopped.

The 30-second explanation

Data exfiltration is the last, unglamorous step of a theft: once attackers have found something worth taking, they still have to move it out of the network. That movement leaves traces, and spotting it in time is often the last real chance to catch the theft before it's done.

How it works

  1. 1

    1. Find

    Valuable files or an entire database are located.

  2. 2

    2. Stage

    Everything is gathered and compressed in one place, ready to move.

  3. 3

    3. Send

    The data is uploaded to a destination outside the organisation.

  4. 4

    4. Cover

    Traces are deleted, or the transfer is disguised to blend into normal traffic.

The typical sequence is find, gather, and send: locate the valuable files or the database, pull them together in one place, compress or encrypt them, then push them out. The route out might be an upload to a cloud service, a direct connection to a server the attacker controls, or data tunnelled inside traffic that looks routine at a glance. Each of those steps changes what shows up on the network and on the endpoint. A server that's never sent an outbound file suddenly pushing gigabytes overnight is the kind of thing defenders are watching for: unusual volume, an unfamiliar destination, an archive nobody remembers creating, a tool that has no business being on that machine.

Real-world example

A server that has never uploaded anything before suddenly sends a very large volume of data to an unfamiliar storage service overnight. Against months of quiet, normal behaviour, the size, the timing and the destination all stand out at once.

How to spot it

  • A spike in outbound volume

    Traffic that sits far above the server or user's normal baseline.

  • A first-time destination

    A connection to a service or address nobody there has ever used before.

  • Archive files appearing from nowhere

    Large compressed files showing up on a server that doesn't normally create them.

  • Transfers at odd hours

    Bursts of activity overnight or across a weekend, when nobody's meant to be working.

What to do

  1. 1Establish what normal outbound traffic looks like, so anything unusual actually stands out.
  2. 2Restrict which systems can reach the internet, and which services they're allowed to upload to.
  3. 3Classify sensitive data and put extra monitoring around wherever it actually lives.

Stay curious. Stay safer.

This is one piece of a bigger picture. Explore more real-world examples, concepts and tips to build your cybersecurity awareness.

Explore More

Keep reading