During the ongoing attack operation, an unauthorized data transfer was detected from the internal network to an external IP. 700GB of sensitive data was exfiltrated before ransomware encryption commenced. The attack was aimed at disrupting HSE's operations.