exfiltration
termsecurity
Getting stolen data out - the stage where an intrusion becomes a breach with consequences.
It is the last chance to notice, and it is deliberately made to look ordinary: uploads to services the organisation already uses, small volumes over long periods, or tunnelling through protocols nobody inspects. DNS is the classic channel precisely because it is allowed everywhere and rarely examined for content. The detectable property is usually shape rather than payload - a volume, a destination or a timing that does not match how that account normally behaves.
Also known as: data theft