Data triage is the rapid sorting of stolen files by sensitivity, business value, or leverage potential. Attackers use it to decide which documents, databases, credentials, or communications are most likely to create pressure on a victim, especially in double-extortion campaigns.
It matters because the faster criminals can identify what is valuable, the faster they can threaten disclosure, target executives, or demand higher ransom payments. In practice, data triage may involve keyword searches, file-type filtering, metadata review, or AI-assisted classification. Defenders should assume exfiltrated data can be prioritized quickly and plan for fast containment, legal review, and incident response. Strong access control, data loss prevention, and clear backup and recovery procedures reduce the payoff of this tactic.