Exfiltration volume is the amount of data an attacker is believed to have copied or removed from a victim environment. It is usually expressed as a size figure, such as megabytes, gigabytes, or terabytes. In threat reports and ransomware listings, this number may be presented as evidence of theft, but it is only a claim unless it is supported by logs, network telemetry, file access records, or recovered malware activity.
This figure matters because it helps defenders estimate impact, prioritize incident response, and decide whether legal, privacy, or notification obligations may apply. In real attacks, exfiltration volume can come from compressed archives, staged files, cloud synchronization, or repeated outbound transfers. In defense work, analysts compare the claimed volume with firewall logs, endpoint detections, and data transfer baselines to see whether the number is plausible. A large exfiltration volume may indicate serious exposure, but by itself it does not prove what was taken, when it was taken, or whether theft actually occurred.