Uh-Oh...

Files being copied to unusual locations is incorrect.

Explanation :

Being alert to the correct signs of data exfiltration is key to prevention. Increased data backup frequency is typically a security measure, not a sign of exfiltration.