Outbound data movement is any traffic leaving a network, host, or cloud service. It can include file transfers, database exports, cloud sync, email attachments, API calls, or encrypted sessions to an external destination. In incident triage, this matters because attackers often try to move stolen data out of the environment before they are detected.
Defenders review outbound data movement to separate normal business activity from suspicious exfiltration. Useful signals include unusual volume, rare destinations, new protocols, odd timing, and transfers from sensitive systems. In real attacks, outbound movement may be a backup of stolen files to attacker infrastructure, but it can also be legitimate admin work, so context is essential. When an organization is named in an extortion claim, checking outbound data movement helps determine whether the claim is backed by technical evidence or is only a public accusation.