Data exfiltration

In late May 2023, the Cl0p gang exploited a flaw in the MOVEit Transfer file transfer software (CVE-2023-34362) and emptied the servers of thousands of organizations without encrypting anything: exfiltration alone carried the extortion. Data exfiltration is the unauthorized transfer of information out of an organization's systems to a destination the attacker controls; MITRE ATT&CK treats it as a tactic in its own right (TA0010). In double extortion it is what keeps a grip on a victim that has good backups. The channels barely change from one case to the next: HTTPS to a consumer cloud storage service, a sync tool such as Rclone pointed at Mega, DNS tunneling that hides data inside normal-looking queries, or a straight push to the command-and-control server. Legally, exfiltrating personal data is a breach under GDPR. The organization must notify the supervisory authority within 72 hours (Article 33), unless the risk to individuals is unlikely, and tell the individuals themselves when the risk is high (Article 34). For the cyber insurer the claim grows accordingly: notification costs, credit monitoring, liability defense, and fines where the governing law allows them to be insured. Proof is the hard part. Working out what left, and how much, often takes weeks of forensics, and the loss estimate hangs on it.