If it was compressed prior to exfiltration it would be much smaller than the original data. I would expect this is mostly human readable text and a fairly high compression ratio. Agree it would still be large but 2 TB at 7:1 ratio drops to 285 GB. I don't know how much these servers are doing with data but I'd suspect sneaking out 10 GB/day over a month or 20GB/day over 2 weeks isn't going to trip up much. The CPU hog for the original compression might, but if you batch out the process in chunks (like a good data engineer), you probably wont trip many thresholds outside of expected use. Just a theory on how I might sneak that much data out of somewhere that has eyes on it, I don't know many details except what's in the article.

I'm less skeptical after seeing it happen to IDScan and terrabytes of government-issued IDs being exfiltrated quietly.

Still skeptical, but the FBI's vendors are just as vulnerable to 0-days as Hertz's vendors.