Data exfiltration is the unauthorized transfer of information out of a system. NIST defines exfiltration in exactly these terms. In practice, it is the step in an attack where stolen files, databases or credentials leave the victim’s environment and reach the attacker.

How it works

MITRE ATT&CK treats exfiltration as its own tactic (TA0010). Common methods include:

• Sending data over the same command-and-control channel the malware already uses.
• Uploading archives to cloud storage or file-sharing services that look like normal traffic.
• Compressing and encrypting data, and splitting it into small pieces, to avoid detection.
• Using removable media or a separate network channel where controls are weaker.

Why it matters for dark web monitoring

Exfiltration is what turns an intrusion into a data breach. It also drives double extortion, where attackers threaten to publish the copied data. Outbound traffic controls and data loss prevention can reduce the risk, but they do not catch everything. When data has already left, it often surfaces later on leak sites, forums or file-sharing services. Services that watch for leaked company data help confirm what was taken and where it is being shared.

Sources: NIST CSRC Glossary: exfiltration, MITRE ATT&CK TA0010: Exfiltration