In a bid to strengthen their negotiating position, SamSam exfiltrated data, adding a layer of data breach to the incident. Sensitive files were transferred from the internal network to an external IP address associated with known malicious activity.