Data exfiltration
Data exfiltration is the unauthorized transfer of data from a system or organization to a destination controlled by, or available to, an attacker.
Access and transfer are different events
An attacker may be able to read a file without having copied it out. They may gather files into an archive before trying to send it elsewhere. A failed transfer attempt is different from a completed one. Keep those stages separate when describing an incident.
MITRE ATT&CK includes several exfiltration routes: an existing attacker communication channel, another network protocol, an external web service, or physical media. Data does not have to leave through an obviously suspicious server. A familiar cloud service can be used as the destination.
Google Threat Intelligence Group’s reporting on UNC6040 describes voice phishing that led to Salesforce data theft. Its later update separately tracks follow-on extortion. That distinction matters: taking data and demanding payment are different activities, even when they belong to the same incident.
Establish what was actually taken
A ransom note or encrypted files do not establish that data left. The ransomware entry covers that distinction. An extortion message cannot settle the question either. Check what the investigation supports about the data, destination, timing, and extent of transfer. A sample may support concern about those particular records without proving that the sender took every dataset they claim.
Missing logs can leave the answer unresolved. “We have not confirmed a transfer” is different from “no transfer occurred.” The extortion-claim guide explains how to keep allegations and corroborated findings separate. External mail forwarding covers one route where a saved setting and actual delivery need different evidence.