Data scope is the set of files, systems, accounts, and records that may have been accessed during a security incident. It is broader than confirmed exfiltration: investigators use it to define the possible blast radius while they are still determining what an intruder could see, copy, alter, or delete.
This matters because the scope of accessed data drives incident response, legal review, and notification decisions. If attackers only touched a single workstation, the impact is different from access to shared drives, databases, or source code repositories. Defenders establish data scope by correlating identity logs, file-access telemetry, endpoint activity, and network records, looking for unusual reads, bulk downloads, archive creation, and outbound transfers. In attacks, data scope often expands quietly before theft is confirmed; in defense, narrowing it helps teams focus containment, preserve evidence, and assess what information may have been exposed.