Cloud Data Exfiltration.

The unauthorized copy or transfer of data out of a cloud account, often via object storage APIs, snapshots, replication, or attacker-controlled accounts. It belongs to the Cloud Security category of cybersecurity.

The unauthorized copy or transfer of data out of a cloud account, often via object storage APIs, snapshots, replication, or attacker-controlled accounts.

Cloud data exfiltration is the stage of an intrusion where attackers move data from compromised cloud services to infrastructure they control. Common techniques include S3 GetObject and Sync, copy of EBS or RDS snapshots into attacker accounts via SharePermission, cross-account replication policies, BigQuery and Athena exports, public-share of buckets, and signed URLs with long expiry. Egress can be hidden inside legitimate services such as object versioning or backup tools. Defences combine least-privilege IAM, deny rules on cross-account share for storage and snapshots, VPC endpoints with Service Control Policies, encryption with customer-managed keys, anomalous-traffic detection, and DLP scanning of stored data.

Defences for Cloud Data Exfiltration typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Cloud egress, Cloud bucket exfiltration.