The final phase of the operation involved transferring 190GB of sensitive source code to external servers. The threat actor Lapsus$ utilized a compromised internal server to exfiltrate the data to an external IP. Subsequently, they leveraged Telegram to initiate extortion, threatening to release the data unless their demands were met.