data exfiltration
The phase of a cyberattack in which stolen data leaves the victim's environment
Data exfiltration is the process by which data is taken out of a protected system, network or account without authorisation and transferred to a destination that the rightful owner does not control. It is, in other words, the phase of a cyberattack in which the stolen information actually leaves the victim's environment — whether by copying, transfer or direct extraction.
In a true crime context, the term is used above all about the systematic extraction of large volumes of data by state-sponsored and criminal hackers. In the case concerning the Chinese military and the Equifax hack, data exfiltration constituted the core offence itself: the attackers penetrated Equifax's systems and then siphoned out the personal data of hundreds of millions of Americans over the course of several weeks without the company detecting it.
Technically, exfiltration can be carried out in many ways: through encrypted connections that disguise the data stream as normal traffic, by using legitimate cloud services as intermediaries, or by physical extraction via portable storage media. The decisive legal and factual element is not the method but the result — that data has left the protected environment without permission.
Under Danish law, data exfiltration is not in itself a separate, named criminal offence, but the acts that make up exfiltration are typically covered by provisions on unauthorised access to data systems and breaches of data security. The term is primarily a technical and operational label describing one phase of a broader criminal act.
