This is why DNS and layer7 filtering is a must.
By using DNS tunneling. The hacker encoded the data into DNS queries and sent it to a DNS server they controlled. Since DNS traffic was allowed through the firewall, the data was exfiltrated without transferring files directly.