Bulk exfiltration is the large-scale removal of data from a network, usually over a short period of time. Attackers often compress, stage, and transfer files to external servers or cloud accounts so they can steal as much information as possible before detection. The data may include personal records, credentials, financial files, source code, or internal documents.
In cyber security, bulk exfiltration matters because stolen data can be sold, leaked, or used for extortion. It is a common part of double-extortion ransomware, where encryption is paired with the threat to publish stolen files. Defenders look for unusual transfer volumes, abnormal destination addresses, new archive creation, and data movement outside business hours. Limiting access, segmenting sensitive systems, monitoring outbound traffic, and alerting on mass file access can help spot or stop exfiltration early.