I'm always wondering how it is possible to exfiltrate more than 2 TB of data shouldn't any sysadmin alarmed? because if you want to do that undetected you need several days to weeks to download that data