Data Exfiltration, also called data leakage or data theft, is the unauthorized transfer or extraction of data from a system, network, or organization to a destination controlled by an attacker or otherwise outside authorized boundaries. It is frequently the ultimate goal of a cyberattack: after gaining access, the attacker’s aim is to steal valuable data – customer records, personally identifiable information, financial data, credentials, intellectual property, or confidential business information – and move it out to where they can exploit or monetize it.
There is a useful nuance between the terms. Exfiltration typically implies deliberate, malicious extraction by an attacker, while leakage can also encompass unintentional exposure – data leaving through misconfiguration, accidental disclosure, or careless handling. Both result in sensitive data ending up where it should not.
Attackers exfiltrate data through many channels: transferring it over the network to external servers, tunneling it within seemingly normal protocols (such as DNS or HTTPS) to evade detection, staging and compressing it before extraction, using cloud storage, or abusing legitimate application functionality. APIs are a significant exfiltration vector because they are designed to return data; an attacker who exploits a broken authorization flaw or an endpoint that exposes excessive data can pull large volumes of records through requests that look, individually, like normal API usage. Aggressive scraping of data through legitimate endpoints is a subtler form of leakage that assembles valuable datasets over many requests.
The impact mirrors that of a data breach: financial loss, regulatory penalties, reputational damage, competitive harm from stolen intellectual property, and privacy harm to affected individuals. Because exfiltration is often the payoff stage of an intrusion, detecting it can also reveal an ongoing compromise.
Defenses focus on both preventing access and detecting abnormal data movement: strong access controls and encryption, data loss prevention (DLP) tools that monitor and block unauthorized transfers, network monitoring for unusual outbound traffic, API monitoring to detect abnormal data volumes and access patterns, least-privilege data access, and limiting how much data any endpoint returns. Because exfiltration frequently hides within legitimate-looking traffic, behavioral and volume-based detection – spotting when access patterns deviate from normal – is central to catching it.