Data Exfiltration

Data exfiltration is the unauthorized transfer of data from an organization's systems to an external destination controlled by a threat actor. It is a common objective in targeted cyberattacks and a frequent outcome of ransomware and advanced persistent threat campaigns. In third-party cyber risk management, vendors with access to sensitive first-party data represent a potential exfiltration pathway if their systems are compromised.

How Does Data Exfiltration Actually Happen?

Most exfiltration relies on access an attacker already has, not a dramatic new break-in, which is what makes it hard to catch in the moment.

Compromised credentials, letting an attacker move data out through the same legitimate access a real employee would use.
Malware and command-and-control channels, where infected systems quietly send data to an attacker's server over time.
Insider actions, whether malicious or careless, from someone who already has legitimate access to the data.
Misconfigured cloud storage, where data is technically exposed rather than actively stolen, but ends up in the wrong hands regardless.

Credential Theft Is the Most Common Starting Point

An attacker rarely needs to defeat a firewall when a stolen username and password will do. Credentials harvested through phishing, leaked credentials already circulating from an unrelated breach, or infostealer malware routinely give an attacker the same access level as the employee they're impersonating, no exploit required.

Unpatched Vulnerabilities Open the Door First

A known exploited vulnerability on an internet-facing system is frequently the first domino, giving an attacker initial access that a later stage of the attack uses to actually move data out. The vulnerability and the exfiltration are two separate events in the same chain, which is why patching alone doesn't guarantee data never left.

How Does Data Exfiltration Differ From a Data Breach?

Data exfiltration is the specific act of moving data to an attacker. A data breach is the broader event of data being exposed, which may or may not involve an attacker actively taking anything. A misconfigured database left open on the internet is a breach the moment it's exposed, whether or not anyone has accessed it yet. Exfiltration specifically requires data to have actually left the organization's control and reached somewhere a threat actor controls. Many publicly disclosed breaches do involve exfiltration, but the two terms describe different moments in an incident, exposure versus theft, and a security team should know which one it's actually dealing with before deciding how to respond.

What Technical Signs Indicate Data Is Being Exfiltrated?

Exfiltration tends to show up in network behavior before it shows up anywhere else, which is why outbound traffic patterns matter as much as inbound defenses. Unusually large data transfers, connections to unfamiliar or blacklisted external destinations, activity concentrated during off-hours, and DNS queries that look more like a covert channel than normal lookups are the technical fingerprints security teams train systems to catch.

Outbound Traffic Tells a Different Story

A firewall built to keep attackers out has little to say about data quietly leaving through a connection that looks legitimate on the surface. That's why exfiltration detection typically depends on baselining what normal outbound traffic looks like for a given system, then flagging deviations from it, rather than relying on the same signatures used to catch inbound attacks.

Volume anomalies, where a system suddenly transfers far more data than its normal baseline.
Destination anomalies, where traffic heads toward a destination the system has never contacted before.
Timing anomalies, where transfers cluster at hours no legitimate business process would explain.

Why Does Data Exfiltration at a Vendor Threaten the Organizations That Rely on It?

A vendor holding a downstream organization's data means a vendor's exfiltration event is that organization's exposure too, regardless of whose systems the attacker actually touched. Double-extortion ransomware makes this dynamic explicit by design, attackers exfiltrate data before encrypting anything, specifically so they retain something to threaten with even if the victim restores from backup without paying. Black Kite's 2026 Ransomware Report found Qilin's victim count grew 443% to 1,358 victims in a single year, a group whose tactics rely on exactly this exfiltrate-then-encrypt sequence.

What Happens to Data After It's Exfiltrated?

Exfiltrated data doesn't sit still. It typically moves toward whatever market or extortion channel monetizes it fastest. Some of it surfaces for sale on dark web marketplaces, some fuels credential-stuffing attacks once usernames and passwords are extracted from it, and some becomes the basis for a direct extortion demand back to the organization it was taken from. Tracking where an organization's own data ends up after an incident is the specific job of dark web monitoring, a distinct discipline from detecting the exfiltration event itself.

Financial services and healthcare organizationsare frequent targets for this reason, since payment details and patient records both carry immediate resale value on criminal marketplaces in a way that, say, internal meeting notes typically don't.

What Should a Risk Team Do When a Vendor Discloses Possible Exfiltration?

The scope of what left the building matters more than the fact that something did, so the first questions should focus on specifics, not reassurance. A vendor inventory that already records what data each vendor handles makes this scoping conversation faster, since the risk team isn't starting from zero on what that vendor could plausibly have touched.

Ask which data types were involved, since customer financial data and internal marketing files carry very different exposure.
Request a timeline, including when the exfiltration is believed to have started, not just when it was discovered.
Check your own exposure directly, rather than relying solely on the vendor's assessment of what data belonged to which customer.
Monitor for secondary use, such as the data appearing on dark web forums or being used in follow-on phishing campaigns.

This is also where a vendor risk response process built ahead of time pays off. A team that has to design its escalation path while also handling a live incident is working at a real disadvantage compared to one running a process it already rehearsed.

How Does Black Kite Detect Signs of Data Exfiltration?

Black Kite's ThreatTrace™ analyzes internet traffic flows to surface suspicious outbound activity and traffic baseline deviations, the network-level signals that often accompany exfiltration, rather than waiting for a vendor to disclose an incident after the fact. Those signals feed into the same continuous monitoring that tracks a vendor's broader risk profile, so a change in outbound traffic behavior shows up as part of the same ongoing picture instead of a separate, disconnected alert.