Uh-Oh...

Files being copied to unusual locations is incorrect.
Explanation :
Being alert to the correct signs of data exfiltration is key to prevention. Increased data backup frequency is typically a security measure, not a sign of exfiltration.