As a final step, the attackers exfiltrated critical data to an external server, preparing to leverage this information in their retro-styled leak site for extortion purposes. The DLP system detected a large volume of sensitive data being transferred to an unknown IP address.