File exfiltration is the unauthorized copying or removal of files from a compromised system. Attackers use it to steal documents, archives, source code, databases, screenshots, or browser data after gaining access through malware, stolen credentials, or a remote-control tool.
It matters because the loss is often silent: a system may keep working while sensitive data leaves over normal-looking network traffic, cloud sync paths, removable media, or encrypted channels. In intrusion chains, exfiltration often follows discovery and collection, when the attacker identifies high-value files and stages them for transfer. Defenders watch for unusual archive creation, unexpected outbound connections, mass access to file shares, and access to browser stores or memory that may contain session material. Strong segmentation, least privilege, endpoint logging, and egress filtering help reduce both the amount of data available and the attacker’s ability to move it out.