What is data exfiltration?
Definition
Data exfiltration is the unauthorized transfer of information out of a system. In practice it means someone copying data out of a computer, account or network without permission.
- Category
- Attacks
- Also called
- exfiltration, data theft, data extrusion
- Last updated
NIST's glossary defines exfiltration in one line: the unauthorized transfer of information from a system. That covers a lot of ground, and the word is used for both outside attackers and people who already have access.
The usual pattern has three parts. Someone gets access to a system, they find data worth taking (customer records, passwords, documents, emails), and they move a copy somewhere they control. The access can come from stolen passwords, malware on a laptop, a phishing email or a misconfigured account. The copy can leave by upload to a cloud account, email, a USB drive or hidden inside normal-looking web traffic.
A typical case: malware on an employee's laptop quietly uploads files from their documents folder to a server the attacker runs. Nothing breaks and no alarm goes off, which is why exfiltration is often found weeks later, if at all.
Why it matters to you
You are rarely the one being attacked directly. A company holding your name, address, email and password gets hit, the data is exfiltrated, and it later appears in a breach dump or gets sold. From then on it fuels phishing, account takeover and identity theft aimed at you.
Exfiltration vs. related terms
- A data breach is the event where protected data is exposed. Exfiltration is one way a breach happens: the data is actually copied out.
- Data leakage is usually accidental, for example a misconfigured storage bucket. Exfiltration is deliberate.
- Data scraping collects information that is already publicly visible. Exfiltration takes data that was not meant to be available.
How to protect yourself
- 1
Use a unique password for every account
If one company is breached and your data is exfiltrated, a unique password stops the attacker from trying the same one on your other accounts.
- 2
Turn on two-factor authentication
Prefer an authenticator app or a security key over text messages for your email, banking and cloud storage accounts.
- 3
Keep devices updated and run security software
Malware is a common way for data to be copied out of a laptop or phone. Updates and anti-malware tools close the usual routes.
- 4
Check what your accounts have connected
Review the apps and services that have access to your email and cloud storage, and remove any you don't recognize or use.
- 5
Know where your details are listed
Data that was exfiltrated often ends up on lookup sites. Serus finds where your address and phone number are listed and removes them, and monitors breach databases and the dark web for your email and passwords.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is data exfiltration the same as a data breach?
Not exactly. A breach is the exposure of protected data. Exfiltration is one way it happens, when someone copies the data out of a system.
How does data exfiltration happen?
Commonly through stolen credentials, malware or phishing that gives an attacker access. The data is then uploaded, emailed or copied to somewhere they control.
Can an insider exfiltrate data?
Yes. The term covers any unauthorized transfer, including by someone who has legitimate access but copies data they should not take.
Sources
Something wrong or out of date? Tell us and we'll re-check it.