Free tools Windows power users keep installed
One-click scans. No signup required.
Hackers can transfer stolen data in minutes, but some breaches take weeks or months. In Verizon’s breach data covering 2014–2020, the most common recorded time-to-exfiltration categories were hours and weeks. Those historical figures describe observed cases—not a clock for any particular attack—and they are not the same as the time it takes an organization to discover a breach.
How long does data theft take?
It depends on the breach. Verizon’s 2021 Cyber-Espionage Report says that, in its 2014–2020 DBIR timeframe, observed exfiltration ranged from minutes to weeks for 88% of the cyber-espionage cases it summarized. In its broader all-breach chart, recorded cases also appeared in the months category. The figures are distributions of incidents, not estimates of how long a specific attacker will take.
Here, “collecting data” means exfiltration: unauthorized transfer of data out of a victim’s environment. It is only one stage of an incident. An attacker may first gain access, explore systems, gather or stage files, and then transfer them; defenders may discover and contain the activity at different points.
What Verizon’s historical figures show
Verizon’s charts divide observed time to exfiltration into categories. The percentages below are from incidents in the 2014–2020 DBIR timeframe, published in Verizon Business’s 2021 report. They are not a per-file transfer speed or a prediction for current breaches.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall#1 Best Overall
| Observed time to exfiltration | All breaches (n=1,098) | Cyber-espionage (n=43) |
|---|---|---|
| Minutes | 6% | 30% |
| Hours | 38% | 14% |
| Days | 9% | 21% |
| Weeks | 37% | 23% |
| Months | 5% | 12% |
In the all-breach chart, hours (38%) and weeks (37%) were the largest displayed categories. The cyber-espionage sample had a different pattern: 88% of its observed exfiltration times fell between minutes and weeks, while 12% were in the months category. The cyber-espionage chart is a smaller, specialized sample, so it should not be treated as representative of every attacker or organization. Verizon Business, 2020–2021 Cyber-Espionage Report.
Do not confuse theft time with detection time
A breach can remain undiscovered long after data has left the network. In the same report’s cyber-espionage analysis, discovery commonly took months to years, even though exfiltration in the subset was generally measured from minutes to weeks. Verizon also describes containment in that analysis as taking hours to weeks. These are separate timelines, not interchangeable ways to measure one “hack duration.”
- Time to compromise: how quickly an attacker gains access. Verizon’s historical framing says successful actors often compromised in seconds to minutes.
- Time to exfiltrate: how long until data is transferred out of the victim environment.
- Time to discover: how long until the organization learns about the breach.
- Time to contain: how long defenders take to stop or limit the incident.
Verizon’s 2026 DBIR materials describe current breach patterns, including that 31% of breaches began with vulnerability exploitation using 2025 data, but the material reviewed does not provide a comparable current exfiltration-time distribution. The 2014–2020 timing charts therefore provide historical context, not a current universal benchmark. Verizon 2026 Data Breach Investigations Report.
Why there is no reliable countdown for an individual breach
The charts report categories across breach cases, not a rate such as gigabytes per hour. Transfer time in an individual incident can depend on the attacker’s access, the amount and location of data, available network paths, and whether the activity is interrupted. The Verizon figures do not establish how long any particular intrusion will take, or how quickly a given quantity of data can be stolen.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
When comparing a breach statistic with another, check which event was timed, which incident population was included, whether the result is a percentage distribution or a median, and the dataset’s dates and sample size. A detection statistic or an average should not be substituted for the chart’s exfiltration categories.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If you suspect data is being stolen
Do not use elapsed time as evidence that an account or network is safe. If a personal account may be compromised, report it to the relevant service provider and follow its recovery guidance. If this may involve a workplace or organization, contact its security team promptly and preserve relevant alerts, messages, and other incident evidence rather than deleting them.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
