# How can we check whether ransomware attackers really stole our data?

Look for the transfer, not the claim. Attackers sometimes exaggerate to raise pressure, and sometimes they did take everything they say. Check firewall and proxy logs for large outbound transfers in the days before encryption, especially to cloud storage or to addresses nobody else uses, and note which internal hosts sent them. Compare the volume with what those servers hold. Request a proof sample only through your responder, and look at what it contains. Cloud storage and SaaS audit logs can show mass downloads. If the evidence shows no significant outbound transfer, that helps the decision and any notification, but absence of evidence on one path does not prove that nothing left by another. NetSenX keeps alerts for unusual outbound data volume per host, with time, destination and volume; it does not see the file names in encrypted transfers.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/how-to-check-whether-attackers-really-stole-our-data

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [Our data is on a leak site. Can we find out when it was stolen?](https://netsenx.com/en/faq/our-data-is-on-a-leak-site-when-was-it-stolen)
- [Does NetSenX record which files were exfiltrated?](https://netsenx.com/en/faq/does-netsenx-record-which-files-were-exfiltrated)
- [Do attackers come back after we clean up?](https://netsenx.com/en/faq/do-attackers-come-back-after-cleanup)
- [What is incident response?](https://netsenx.com/en/faq/what-is-incident-response)
- [What are the phases of incident response?](https://netsenx.com/en/faq/what-are-the-phases-of-incident-response)