Previously sensitive data that has been “de-identified” through techniques such as masking, encryption, and/or tokenization to remove the PII. Obfuscated data exfiltrated as part of a security incident has no value to a threat actor.