A data breach is an event where unauthorised access occurs. Data exfiltration is the subsequent transfer of that accessed information to an external destination. You can have a breach without exfiltration if the attacker is detected before copying files. You cannot have exfiltration without a prior breach of access controls.
What is the difference between data breach and data exfiltration?
The difference between data breach and data exfiltration lies in the distinction between access and removal. A data breach is any incident where unauthorised parties gain access to sensitive information. Data exfiltration is the specific process of copying and transferring that information out of the secured environment. One is a failure of perimeter defence; the other is a failure of data movement controls.
Can a breach occur without exfiltration?
Yes, a breach can occur without any data leaving the organisation. An attacker may gain access to a system, explore the network, and install backdoors, but leave before copying any files. This is often called a reconnaissance phase. The security event is still a breach because confidentiality was compromised, even if no specific records were stolen. Detection at this stage prevents the financial and reputational damage of actual data loss.
How does data exfiltration typically happen?
Data exfiltration usually happens over standard network channels to avoid triggering alarms. Attackers often use HTTPS traffic, which is encrypted and common, to hide stolen data inside normal web browsing activity. They may also use cloud storage services, email attachments, or DNS queries to tunnel data out. The goal is to make the outbound traffic look like legitimate user behaviour. This makes simple firewall rules ineffective against sophisticated theft.
| Characteristic | Data Breach | Data Exfiltration |
|---|---|---|
| Primary Action | Unauthorised Access | Data Transfer |
| Detection Focus | Anomalous Login | Anomalous Volume |
| Immediate Risk | System Compromise | Information Loss |
| Prevention Layer | Identity & Access | Network Egress Control |
Why do standard firewalls fail to stop exfiltration?
Standard firewalls often fail because they focus on inbound threats rather than outbound data integrity. Most organisations allow outbound HTTPS traffic by default to enable business operations. An attacker exploits this trust by encapsulating stolen data within encrypted web requests. Without deep packet inspection or user behaviour analytics, the firewall sees only a valid connection to a legitimate website. It cannot see the payload being extracted.
What is the role of data classification in this context?
Data classification determines what you actually need to protect. If you treat all data as equally sensitive, you cannot prioritise your detection efforts. By tagging critical assets, you can apply stricter egress controls only to that specific data. This reduces noise in your security alerts. Refer to our guide on data classification for methods to automate this tagging process across your file servers and databases. Without classification, you are defending everything with the same limited resources.
See also: Intrusion Detection for Small Business: Practical Low-Cost Methods · NoSQL Injection Recovery: Stabilise, Eradicate and Prevent Recurrence
How does dwell time affect the outcome?
Dwell time is the period between initial compromise and detection. Longer dwell time increases the likelihood of exfiltration. Attackers often wait weeks to understand the network before stealing data. During this time, they map out valuable assets and test their ability to move data without detection. Reducing dwell time through continuous monitoring limits the window for theft. See our analysis of breach dwell time for strategies to shorten this critical interval.
What are the limitations of data masking here?
Data masking replaces sensitive data with fictional but realistic substitutes. It protects data at rest and in development environments. However, it does not help if the attacker accesses the production database where real data resides. If the breach occurs in the live environment, masking is irrelevant. You must secure the production access points. Refer to our database security overview for hardening measures that protect live assets from unauthorised queries.
How do data subject rights complicate investigation?
Data subject rights allow individuals to request their personal data from organisations. Attackers sometimes exploit these legal channels to exfiltrate data. They may create fake identities or use compromised accounts to request bulk data exports. The organisation, bound by law, processes the request and sends the data. This looks like legitimate compliance activity. You must verify the identity of the requester and the context of the request. See our data subject rights guide for verification workflows.
Why is data sovereignty relevant to exfiltration?
Data sovereignty laws dictate where data can be stored and processed. Exfiltration often involves moving data to servers in different jurisdictions. This creates legal complications beyond the technical breach. If data leaves the country, you may violate local regulations. Monitoring data egress helps ensure compliance with these geographic restrictions. Refer to our data sovereignty framework for mapping data flows against legal requirements.
What is the impact on PCI DSS compliance?
PCI DSS requires strict controls over cardholder data. Exfiltration of this data triggers severe penalties and mandatory forensic reviews. The standard mandates monitoring all outbound traffic for sensitive data. Failure to detect exfiltration is a direct violation of requirement 10.6. You must log and review all access to network resources and cardholder data. See our PCI DSS checklist for specific logging requirements that support exfiltration detection.
How do printed document leaks relate to digital theft?
Digital exfiltration is not the only threat. Attackers may print sensitive documents and walk out with them. This bypasses network monitoring entirely. Physical security controls must complement digital ones. Badge access logs and camera footage are essential for tracking physical removal. Refer to our printed document leaks guide for integrating physical security logs with digital incident response.
Key takeaways
- Breach detection focuses on unauthorised entry; exfiltration detection focuses on unusual outbound data volume.
- Exfiltration often uses standard protocols, making it harder to distinguish from legitimate business traffic.
- Containing a breach stops damage; stopping exfiltration requires monitoring egress points, not just entry points.
A breach is the entry; exfiltration is the exit. Monitor outbound traffic patterns as closely as you monitor inbound connections to catch data leaving your network.
Frequently asked questions
Is data exfiltration always malicious?
No, insiders may exfiltrate data for legitimate business reasons, such as remote work or sharing with partners, but without proper authorisation it is still a security incident.
Can I stop exfiltration after a breach?
You can limit further exfiltration by revoking access credentials and blocking outbound connections from compromised systems, but data already sent cannot be recalled.
Does 2FA prevent exfiltration?
2FA prevents unauthorised access, reducing the chance of a breach, but it does not stop an attacker who has already gained valid credentials from copying data.
How do I detect slow exfiltration?
Look for small, consistent data transfers over long periods, which often evade threshold-based alerts designed to catch large, sudden spikes in traffic.
How this guide was produced: written by the AppSec Scoop editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
