Topic starter
18/08/2026 2:25 pm
TL;DR: Data exfiltration still moves through familiar paths such as insiders, phishing, external device transfers and supply-chain exposure, with Jscrambler’s article contrasting leakage with deliberate theft and citing SunTrust and MOVEit as examples. The practical lesson is that exfiltration control depends on visibility into data movement, not just perimeter defense.
Editorial analysis by NHI Mgmt Group, based on content published by Jscrambler: “Starting Letter: D”.
By the numbers:
- Nearly 500 organizations and 24 million individuals have been exposed through the mass exploitation of the MOVEit vulnerability, according to Emsisoft research cited by Jscrambler.
- At least 136 organizations that did not use MOVEit directly were exposed via third-party vendors, according to Emsisoft research cited by Jscrambler.
Key questions
Q: What is the difference between data leakage, data breach, and data exfiltration?
A: Data leakage is accidental exposure of sensitive information, often caused by misconfiguration or human error.
Q: Why do insiders and phished users remain effective exfiltration paths?
A: Because both paths often use valid identity and access rather than obvious malware.
Q: What are the signs that secrets exfiltration controls are not working well enough?
A: Common warning signs include secrets appearing in commits, pull requests, or build logs, repeated detection of the same credential type, and slow remediation after exposure.
Practitioner guidance
- Separate leakage from exfiltration in incident triage Classify each event by whether the data was merely exposed or actively removed, then route it to the right investigative and containment workflow.
- Correlate identity activity with unusual data movement Pair successful logins, privilege use and third-party sessions with destination analysis so legitimate access that turns into transfer is visible.
- Review third-party data paths and delegated access Inventory where vendors, integrations and shared services can move sensitive data, then restrict or monitor those paths as exfiltration routes.
Bottom line: The article separates accidental leakage from intentional exfiltration, and that distinction changes which controls and response workflows matter most.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:16 pm
Data exfiltration is fundamentally a governance and observability problem, not just a perimeter problem. If teams can see logins but cannot see where data goes next, they are blind to the actual loss event. That is why exfiltration control must join identity telemetry, data access context and destination analysis into one control view. Practitioners should treat movement visibility as a primary control objective.
A question worth separating out:
Q: How should organisations respond when a vendor exposure creates downstream data loss?
A: Treat the vendor path as part of your own exposure surface. Contain the affected integrations, review delegated access, trace what data may have been reached and reset trust assumptions for the third-party workflow before it is reopened.
👉 Read our full editorial: Data exfiltration persists through insiders, supply chains and leaks