The size of the data taken seems large initially. However, the method/timeline of NK's op data exfiltration is an unknown in the story. I am curious of the details if ever available. Obviously if this is over a period of enough time and a proper transfer protocol or tricky entropy based method that much data may go unnoticed. The real concern would be network security and method exploit and breach into the network.

Don't network security usually have some type of heuristics in place that detect abnormal patterns of data access, and cuts it off?

My head spins from reading about security breaches like this.