Sensitive data was exfiltrated using encrypted channels, indicating a potential ransom demand or further exploitation. The data was sent to an external IP known for malicious activities. The file 'customer_data_backup.zip' was detected leaving the network from an internal host using unusual ports.