If it was compressed prior to exfiltration it would be much smaller than the original data. I would expect this is mostly human readable text and a fairly high compression ratio. Agree it would still be large but 2 TB at 7:1 ratio drops to 285 GB. I don't know how much these servers are doing with data but I'd suspect sneaking out 10 GB/day over a month or 20GB/day over 2 weeks isn't going to trip up much. The CPU hog for the original compression might, but if you batch out the process in chunks (like a good data engineer), you probably wont trip many thresholds outside of expected use. Just a theory on how I might sneak that much data out of somewhere that has eyes on it, I don't know many details except what's in the article.

Na, they just linked it up to the VLAN that carries the netflix traffic and no one noticed because it wasn't even a drop.

Now, I made that totally up, but this is how things go. They'll watch one area like a hawk only to leave another glaringly wide door open.

What is even worse is there are a lot of horrifically inefficient apps out there calling way too much data for no reason and suddenly a hack of an entire database gets lost as noise in relation to all the traffic on the servers and networks.

Anomaly detection is getting better. A small delta can still trigger it. Wether a human reviewed it is another story. But the post mortem will reveal all the signs in hindsight.

I'm less skeptical after seeing it happen to IDScan and terrabytes of government-issued IDs being exfiltrated quietly.

Still skeptical, but the FBI's vendors are just as vulnerable to 0-days as Hertz's vendors.

Imagine the AWS bill