Rapid Data Exfiltration via AI Deepfake Attack Targets Government Agencies

• •Attackers used a deepfake to gain access to sensitive government data.
• •Data exfiltration occurred within 39 seconds of initial access.
• •The median time from intrusion to data theft has dropped to 72 minutes.

A recent cybersecurity incident involved an attacker using a deepfake to manipulate a help desk employee, gaining unauthorized access to an organization's network. Within 39 seconds, the attacker exfiltrated millions of records, highlighting the urgency for state and local governments to enhance their data protection measures. The Palo Alto Networks 2026 Unit 42 Global Incident Response Report indicates that the fastest 25% of data exfiltration incidents in 2025 occurred within a median time of 72 minutes. This incident underscores the evolving tactics of cybercriminals, who now prefer stealing data outright rather than encrypting it for ransom. Sensitive information held by government agencies, such as Social Security numbers and criminal records, is particularly at risk. The report emphasizes the need for IT leaders to improve their mean time to contain intrusions, which has significantly decreased over the past year. With attackers increasingly leveraging stolen data for extortion, the threat landscape for government entities remains critical.