How do we find out what data was stolen?
Look at what left the network, and when: firewall and proxy logs, cloud storage audit logs and the logs of the machines involved. Large uploads to cloud storage or to an unfamiliar address in the days before encryption are the usual sign. Ask your incident-response provider to compare the volumes with what each server holds, and preserve the logs before they are overwritten. If the attackers publish a sample on a leak site, it tells you something about what they took, though rarely everything, and their claims are not proof either way. NetSenX keeps its alerts for unusual outbound data volume per host, with time, destination and volume, which helps you size a transfer. It does not see file names inside encrypted sessions.