Data exfiltration persists through insiders, supply chains and leaks

At a glance

What this is: This is a practical overview of common data exfiltration paths and the article’s key distinction between data leakage and deliberate data theft.

Why it matters: It matters because IAM, NHI and broader security teams need visibility into data movement, user behavior and third-party access paths, not just perimeter controls.

By the numbers:

• Nearly 500 organizations and 24 million individuals have been exposed through the mass exploitation of the MOVEit vulnerability, according to Emsisoft research cited by Jscrambler.
• At least 136 organizations that did not use MOVEit directly were exposed via third-party vendors, according to Emsisoft research cited by Jscrambler.

Context

Data exfiltration is the unauthorized removal of information from an organisation, while data leakage is exposure that starts with a control weakness or misconfiguration. The distinction matters because teams often treat both as the same problem even though the controls required to prevent, detect and respond are different. In practice, the article spans human error, insiders, phishing and supply chain exposure, which means identity governance and data movement visibility both matter.

For IAM and NHI practitioners, the interesting part is not only who had access, but how data left the environment and whether that movement was detectable. Third-party access, device transfers and malicious insiders all create paths where credentials, trust relationships or weak oversight become the enabler for exfiltration. That makes this a governance problem as much as a monitoring problem.

Key questions

Q: What is the difference between data leakage, data breach, and data exfiltration?

A: Data leakage is accidental exposure of sensitive information, often caused by misconfiguration or human error. A data breach is unauthorized access to confidential data, regardless of whether anything is removed. Data exfiltration is intentional copying or transfer of data to an attacker-controlled destination. The distinction matters because each requires a different detection and response strategy.

Q: Why do insiders and phished users remain effective exfiltration paths?

A: Because both paths often use valid identity and access rather than obvious malware. An insider already has trust, while a phished user can be tricked into authorising transfer or revealing credentials. Security teams need controls that watch what authenticated sessions do with data, not just whether the login succeeded.

Q: What are the signs that secrets exfiltration controls are not working well enough?

A: Common warning signs include secrets appearing in commits, pull requests, or build logs, repeated detection of the same credential type, and slow remediation after exposure. Another signal is when teams rely on manual review instead of automated scanning and response. If repositories keep resurfacing with the same sensitive patterns, the control is not keeping pace with development activity.

Q: How should organisations respond when a vendor exposure creates downstream data loss?

A: Treat the vendor path as part of your own exposure surface. Contain the affected integrations, review delegated access, trace what data may have been reached and reset trust assumptions for the third-party workflow before it is reopened.

Technical breakdown

Data leakage vs. data exfiltration

Data leakage is passive exposure created by fragility, such as a misconfiguration, vulnerable process or human mistake. Data exfiltration is active theft, where an actor copies or transfers information out of the organisation with intent. The control difference is important because leakage may be prevented by hardening and review, while exfiltration often requires behavioural detection, egress monitoring and response to unusual movement patterns. In identity-heavy environments, those patterns often emerge through authenticated sessions, third-party access or abused privileges rather than obvious perimeter intrusion.

Practical implication: Classify incidents by exposure versus theft so the right control path, detection logic and response owner are engaged.

How insiders and phishing create exfiltration paths

Insider-driven exfiltration usually depends on legitimate access being used for an illegitimate purpose, which makes it difficult to spot with network controls alone. Phishing and social engineering can create the same outcome by stealing credentials or convincing users to move data to attacker-controlled locations. In both cases, the identity layer is central: access, authentication and trust are what make the transfer possible. Monitoring needs to cover data access context, destination risk and anomalies in user behaviour, not just login success or failure.

Practical implication: Correlate identity events with data movement and destination risk to catch legitimate sessions used for unlawful transfer.

Why supply-chain exposure expands the blast radius

Supply-chain exfiltration is broader than a direct compromise because a vendor or downstream service can expose data even when the primary organisation is not the initial victim. The MOVEit example shows how third-party dependencies can turn one vulnerability into many organisations’ exposure. That pattern is especially relevant where service accounts, integrations, APIs or delegated access carry data across organisational boundaries. Once trust is externalised, the organisation must govern data movement and third-party exposure as an ongoing condition, not a one-time assurance exercise.

Practical implication: Map third-party data paths and delegated access so vendor exposure does not become your hidden exfiltration channel.

Threat narrative

Attacker objective: The objective is to remove sensitive information from the organisation without detection, whether for theft, resale or criminal sharing.

1. Entry occurs through one of the article’s common paths, such as phishing, insider access or a vulnerable third-party service.
2. The attacker or malicious insider uses legitimate access or exploited trust to locate data worth stealing.
3. Data is copied out through external transfer, third-party exposure or another channel that looks like ordinary activity until the movement is analysed.

Breaches seen in the wild

• Ledger Connect Kit npm compromise 2023: Attackers phished a former Ledger employee with unrevoked npm access and published a wallet-draining Connect Kit, stealing about $600k on 14 Dec 2023.
• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Data exfiltration is fundamentally a governance and observability problem, not just a perimeter problem. If teams can see logins but cannot see where data goes next, they are blind to the actual loss event. That is why exfiltration control must join identity telemetry, data access context and destination analysis into one control view. Practitioners should treat movement visibility as a primary control objective.

Insider risk and third-party risk converge once access is already granted. The article’s examples show that exfiltration often happens after trust has been established, which means the failure is not simply initial compromise. The more precise concept is exfiltration visibility gap: organisations know a session existed, but not whether it was used to remove data. Practitioners should tighten detection around authenticated access paths that can move sensitive information.

Supply-chain exposure turns a single control weakness into distributed loss. MOVEit illustrates that downstream exposure can be broader than the direct victim’s environment, especially when delegated access or vendor connectivity is involved. This is where identity governance intersects with data security, because external trust relationships can become the hidden transport layer for exfiltration. Practitioners should model third-party pathways as part of their data-loss control strategy.

Leakage and exfiltration should not be managed as the same incident class. Leakage points to control fragility, while exfiltration points to an actor actively moving data. Blending them leads to weak response priorities and poor metrics. Practitioners should separate exposure prevention from theft detection so the control stack matches the real threat.

Data movement controls are now as important as access controls for identity-led environments. When users, service accounts or vendors can reach sensitive data, the question becomes whether movement can be constrained, explained and audited. That shifts the discipline from simple authorization toward continuous governance of where information can go. Practitioners should align monitoring, incident response and third-party oversight around that reality.

What this signals

Data-loss programmes need to move beyond perimeter thinking and treat authenticated data movement as the event to watch. When insiders, vendors or phished users can export information without a corresponding visibility layer, the organisation has already lost the governance contest.

Exfiltration visibility gap: the next control frontier is not only blocking access, but proving where sensitive data went after access was granted. That means identity telemetry, third-party oversight and egress monitoring need to converge in one operational model.

For practitioners

• Separate leakage from exfiltration in incident triage Classify each event by whether the data was merely exposed or actively removed, then route it to the right investigative and containment workflow.
• Correlate identity activity with unusual data movement Pair successful logins, privilege use and third-party sessions with destination analysis so legitimate access that turns into transfer is visible.
• Review third-party data paths and delegated access Inventory where vendors, integrations and shared services can move sensitive data, then restrict or monitor those paths as exfiltration routes.
• Detect anomalous transfer behaviour from trusted users Set alerts for unusual downloads, exports, removable-device use and script behaviour so trusted identities cannot quietly stage or export data.

Key takeaways

• The article separates accidental leakage from intentional exfiltration, and that distinction changes which controls and response workflows matter most.
• Insiders, phished users and supply-chain dependencies can all move data out of the environment while appearing legitimate at the access layer.
• Practitioners need visibility into authenticated data movement, not only perimeter defence, if they want to detect and limit loss in time.

Key terms

• Data exfiltration risk: Data exfiltration risk is the possibility that sensitive information leaves approved systems and enters an environment the organisation does not control. With Shadow AI, that often happens through ordinary user behaviour, which makes identity governance and data governance tightly linked rather than separate problems.
• Data Leakage Point: A data leakage point is any system, workflow, or collaboration channel where sensitive information can escape intended controls. In modern development, leakage points often include chat apps, support tickets, cloud documents, and observability tools, especially when teams prioritize speed and reuse credentials or secrets informally.
• Exfiltration Visibility Gap: An exfiltration visibility gap is the inability to see where sensitive data goes after access is granted. It appears when identity logs exist, but the organisation cannot reliably connect sessions, destinations and transfer behaviour to a loss event.
• Third-Party Exposure: Third-party exposure is the risk created when outside suppliers, partners, contractors, or service providers can access an organization’s systems, data, or identities. It includes direct and indirect access paths, shared credentials, integrations, and trust relationships. In identity security, it is managed by limiting privileges, monitoring access, and validating external controls.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.