Typically the perpetrators in these cases will trickle the data out over a very long period of time, thus evading many alarm triggers.