Data Exfiltration
0 confirmed incidents.
VERIS: hacking:Use of stolen credsMITRE ATT&CK: T1020 (Automated Exfiltration)T1041 (Exfiltration Over C2 Channel)T1567 (Exfiltration Over Web Service)T1213 (Data from Information Repositories)
MITRE ATT&CK technique names and ids on this page are reproduced and distributed with the permission of The MITRE Corporation. © 2015–2026, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
Data exfiltration is the most direct attack-type classification on the site: an attacker who already reached a system copies data out of it. It maps to four MITRE ATT&CK techniques: T1213 (Data from Information Repositories), collecting data from a wiki, ticketing system or similar internal repository; T1020 (Automated Exfiltration), transferring it out with a script or tool; T1041 (Exfiltration Over C2 Channel), sending it out over the same channel used to control the compromised system; and T1567 (Exfiltration Over Web Service), sending it out through an ordinary web or cloud-storage service to blend in with normal traffic.
No confirmed incidents currently carry this attack-type classification.
Questions and answers
How many confirmed incidents are classified as Data Exfiltration on Breach Census?
0 confirmed incidents are currently classified as Data Exfiltration.
Which MITRE ATT&CK techniques does the Data Exfiltration classification cover?
This classification maps to MITRE ATT&CK techniques T1020 (Automated Exfiltration), T1041 (Exfiltration Over C2 Channel), T1567 (Exfiltration Over Web Service), T1213 (Data from Information Repositories).
What counts as a confirmed incident for the Data Exfiltration classification?
An incident counts here once it carries the Data Exfiltration attack-type classification and has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.