How State and Local Governments Should Approach Data Exfiltration Prevention

What Is Data Exfiltration and Why Is It Spreading Across Government Agencies?

Put simply, data exfiltration is data theft. Bettencourt defines it as “taking data unauthorized out of the environment.”

State and local governments hold sensitive information that is appealing to attackers. Bad actors can use that information to extort officials or sell it to other criminals. Law enforcement and court case management records may include information such as Social Security numbers, dates of birth, mental health information, criminal background information and more.

“The target environment is very rich,” Bettencourt says.

In the past, attackers may have sought to encrypt networks after stealing data to lock out IT officials and demand a ransom. Today, however, they have less incentive to do so. Unit 42 has seen fewer incidents in which attackers rely on encryption and more incidents in which they use stolen data itself as a source of pressure. Bettencourt says the shift reduces the amount of work required.

“If they’re already going to break in and steal data, why encrypt? Simply breaking in and stealing data reduces a lot of friction,” he says.

Bad actors still have leverage without encrypting: Pay — or risk the release of stolen sensitive data.

READ MORE: How states secure the cloud era with identity-first strategies.

IT Leaders Must Overcome the 72-Minute Data Exfiltration Window

Unit 42 based its most recent report on more than 750 incident response engagements in 2025. Among the fastest quarter of incidents involving data theft, the median time from initial access to data exfiltration was 72 minutes.

Only a year earlier, it was 285 minutes.

That comparison puts pressure on defenders. Government IT officials are keen to measure the mean time to contain, which is how long it takes them to stop an attacker after an intrusion begins. The target window has shrunk dramatically in a short time.

Bettencourt says he has briefed more than 200 clients recently and cannot recall one confidently saying its mean time to contain was less than 72 minutes.

“That means they’re already behind last year’s threat actors,” he says.

AI could compress the timeline further. Bad actors are using AI to speed up their work, including identifying vulnerabilities and developing working exploits, Bettencourt says.

For state and local agencies, fast detection by itself is not enough. “You can alert to a threat actor really, really fast, in seconds, but if it takes you hours to kick them out, does it really matter that you found out in seconds?” Bettencourt says.

How Attackers Use Identity Weaknesses To Stage Government Data Theft

Identity weaknesses played a role in nearly 90% of Unit 42 investigations in 2025. Identity-based techniques accounted for 65% of initial unauthorized access.

Some attackers buy stolen credentials, but many rely on social engineering exploits.

Phishing remains common, but the techniques have changed, according to Unit 42. Instead of attaching malware to an email message, an attacker may direct a user to a fake version of a familiar sign-in page.

The victim enters a username, password and multifactor authentication information. The attacker can then use those credentials to sign in to the real system.

Others call employees and pose as help desk staff, directing them to a fake site or asking them to take an action that grants access to a bad actor.

“It’s a lot easier to trick somebody into giving you the keys to the lock than to try to pick the lock or kick the door down,” Bettencourt says.

A valid account also makes the attacker harder to identify. Security teams must determine whether activity came from the real employee or from someone using that employee’s login credentials.

EXPLORE: How state and local governments can secure IoT devices.

What Are Attack Vectors for Data Exfiltration?

An agency’s attack surface includes public websites, application programming interfaces and online forms that connect to back-end systems. A poorly secured citizen-facing form, for example, could give an attacker a path to a system that was never meant to be publicly accessible.

IT security officials should identify those connections and remove anything the government doesn’t require or harden those things that it needs. They also should identify critical systems that must keep operating through an emergency.

For a law enforcement agency, that could include dispatch and call-taking systems. For a court, it could include systems used to schedule hearings or retrieve records.

Bettencourt recommends keeping those systems patched, checking their configurations and limiting the number of accounts with access to them.

The goal is to reduce what an attacker can reach if an account or device is compromised.

Click the banner below to receive the latest state and local insights to your inbox.

Using AI-Powered Detection for Data Exfiltration Prevention

AI also has a defensive role.

Bettencourt points to vulnerability management as one example. Large organizations may have hundreds of thousands of known vulnerabilities, far more than staff can fix at once. AI can help rank them in order of priority. AI systems can determine system exposures and how easy it would be for a bad actor to exploit them. That allows agencies to focus on weaknesses that create a direct path into important systems instead of treating every vulnerability as equally urgent.

AI can also help security teams connect alerts from different tools. Unit 42 found that 87% of intrusions involved activity across more than one attack surface. That creates a problem for agencies using separate products for email security, endpoint detection, backups and other functions.

If those tools do not share data, security analysts may have to monitor multiple systems and manually piece together what happened while an attack continues.

DISCOVER: How agencies are replacing fragmented security monitoring with centralized solutions.

How Can Agencies Build a Data Exfiltration Response Plan?

Bettencourt says agencies must address three priorities:

1. Reduce the chance of a breach.
2. Reduce the damage if one occurs.
3. Cut the time required to contain the attacker.

The last point is where fragmented security tools can become a serious problem.

Bettencourt describes a common setup in which an organization has one vendor for email, another for endpoint security and another for backups. Each tool produces its own alerts and data. Analysts then have to switch among systems, copy information out and piece it together manually.

“They’re trying to work against machine-speed attacks by switching between different portals for different data,” Bettencourt says.

Centralizing those alerts can shorten the investigation and give analysts a clear picture of attacks.

Security officials should also know in advance who can disable an account, isolate a device or cut off access to a system when an incident occurs. Waiting to sort out those responsibilities after an attacker gets inside costs time, Bettencourt says.

The 72-minute figure makes the problem concrete. For some agencies, the attacker may already be stealing data before the security team has figured out what happened.