Often the data isn't exfiltrated at all, only encrypted in place, which should be relatively easy to prove.
Often the data isn't exfiltrated at all, only encrypted in place, which should be relatively easy to prove.