Attack #8: Data Exfiltration

When data leaves the organization

Threat snapshot – Data Exfiltration

How the attack works

Data exfiltration is rarely the first step.
It is usually the objective.

Once attackers gain access through phishing, malware, credential abuse, or insider activity, they begin identifying valuable data.

This may include:

• customer databases
• financial records
• internal documents
• intellectual property

Data is then collected, staged, and transferred outside the organization. Sometimes slowly, to avoid detection. Sometimes in large volumes.

The transfer may use:

• encrypted channels
• cloud storage services
• legitimate tools

From a system perspective, the activity can appear normal.

That is what makes exfiltration difficult to detect.

Real-World Cases

The following incidents demonstrate that data exfiltration is often the primary objective of a cyberattack. Once attackers gain access, they focus on identifying, collecting, and extracting valuable information that can later be used for extortion, financial gain, or follow-on attacks.

MOVEit Transfer (2023)

Sector: Multiple Industries

How did the incident begin?
The CL0P group exploited a zero-day vulnerability (CVE-2023-34362) in MOVEit Transfer to gain unauthorized access to internet-facing systems and extract files directly from affected servers.

What was compromised?

• data belonging to more than 3,300 organizations;
• personal information of over 114 million individuals;
• financial, healthcare, government, and corporate documents.

How did the attack develop?
After successfully exploiting the vulnerability, the attackers automated the extraction of data from compromised systems. In most cases, they did not deploy ransomware but relied on stolen information for extortion.

Operational and financial impact

• more than 114 million affected individuals;
• significant notification, investigation, and regulatory costs;
• legal claims and substantial reputational damage for many organizations.

What could have reduced the impact?

• timely security patching;
• limiting public exposure of file-transfer systems;
• monitoring for unusual large-scale data transfers;
• Data Loss Prevention (DLP) and outbound traffic controls.

Snowflake Customer Data Theft (2024)

Sector: Cloud Services and Multiple Industries

How did the incident begin?
Attackers used compromised credentials obtained from previous infostealer campaigns. Some affected Snowflake environments did not enforce Multi-Factor Authentication (MFA), allowing unauthorized access without exploiting a vulnerability in the platform itself.

What was compromised?

• data belonging to dozens of organizations, including Ticketmaster, Santander, and others;
• personal information of millions of customers;
• customer databases, financial records, and business information.

How did the attack develop?
After successfully authenticating, the attackers extracted large volumes of information from cloud storage environments. The stolen data was later used for extortion, sale, or public disclosure.

Operational and financial impact

• multiple international organizations affected;
• millions of customer records exposed;
• significant investigation, notification, and recovery costs;
• increased focus on cloud identity protection and mandatory Multi-Factor Authentication (MFA).

What could have reduced the impact?

• Multi-Factor Authentication (MFA) for all user accounts;
• regular reviews of active credentials;
• monitoring for unusual queries and bulk data exports;
• least-privilege access controls;
• continuous monitoring of cloud environments.

What do these incidents show?

In MOVEit Transfer, a single zero-day vulnerability enabled attackers to steal data from more than 3,300 organizations, affecting over 114 million individuals. In Snowflake, attackers used previously compromised credentials and the absence of Multi-Factor Authentication (MFA) to access customer cloud environments and exfiltrate sensitive information without exploiting a platform vulnerability.

Both incidents demonstrate that, once attackers gain access, the primary objective is often the theft of valuable information rather than service disruption. Monitoring outbound data transfers, protecting identities, and detecting abnormal data-access patterns early are essential for limiting the impact of data exfiltration.

Who they most often target

Data exfiltration focuses on value.

Roles

• employees with access to sensitive data
• finance and operations teams
• developers and data analysts
• administrators

Sectors

• finance
• healthcare
• technology
• manufacturing
• public sector

Organization types

• data-driven organizations
• companies handling regulated data
• environments without data classification
• organizations with broad access permissions

The more valuable the data, the higher the risk.

What the attack relies on

Exfiltration succeeds when data is accessible and unmonitored.

Human factors

• misuse of access
• lack of awareness
• insider behavior

Technical gaps

• lack of data visibility
• weak monitoring of outbound traffic
• missing DLP controls
• excessive access permissions

Process weaknesses

• no data classification
• unclear data ownership
• lack of monitoring policies
• insufficient auditing

Data that is not controlled is easy to move.

How it is detected

Detection depends on identifying unusual patterns.

What users may notice

• slower systems
• unusual file access
• unexpected data changes

What IT teams observe

• large data transfers
• abnormal access patterns
• unusual use of cloud storage

What SOC teams detect

• anomalous outbound traffic
• data movement patterns
• correlation with compromised accounts
• suspicious use of legitimate tools

Exfiltration often blends into normal activity.

How impact is contained

Once data begins to leave, response must be immediate.

Key actions include:

• stopping ongoing data transfers
• isolating affected systems
• restricting access
• preserving logs and evidence
• assessing what data was exposed

What does not help:

• delaying response
• assuming the transfer is legitimate
• ignoring early signals

The faster the response, the lower the impact.

What realistically helps

Managing data risk requires visibility and control.

People

• awareness of sensitive data
• accountability for access

Processes

• data classification
• access reviews
• monitoring policies

Technology

• data loss prevention (DLP)
• network monitoring
• access control systems
• SOC visibility

Data protection is not only about storage.
It is about movement.

Common myths

“Data is safe inside the network”
“Encryption alone is enough”
“If access is authorized, it is not a risk”
“Exfiltration is easy to detect”

In reality, exfiltration often uses legitimate access and tools.

Attack #1: Phishing & Social Engineering

Attack #2: Credential Abuse & Account Takeover

Attack #3: Business Email Compromise (BEC)

Attack #4: Ransomware

Attack #5: Supply Chain Attack

Attack #6: Insider Threat

Attack #7: Malware & Infostealers

Next: Attack #9 – Privilege Escalation & Lateral Movement