Data extraction is the unauthorized copying or export of information from a system. It may involve downloading files, running database queries, exporting records, or using APIs and admin tools to pull out sensitive data. The access can look legitimate if the attacker has stolen credentials or is abusing a trusted account.
It matters because many breaches are judged by what leaves the environment, not just what was accessed. Even when a portal stays online and no malware is obvious, extracted data can fuel fraud, phishing, impersonation, and further account abuse. Defenders look for signs such as unusual query volume, bulk exports, access at odd hours, unexpected destinations, and accounts touching data outside their normal role. Strong logging, privilege limits, segmentation, and alerting on export activity help detect and contain extraction before large data sets are removed.