You work for a payment credit card organization. During your investigation as an incident response analyst, you have determined that the compromised device that you have collected evidence on from the exploit is a critical server that the company houses:

Customer Personal Identifiable Information (PII) such as:
Name, Address, SSN#s, DOB, etc), .
You have determined in your investigation that daily during after work hours between the hours of 10 pm to 11 pm, that files associated with this data are exfiltrated from the compromised device.