1. A method for halting an unauthorized bulk data copy operation, comprising: receiving, from a user, a request indicating access to a file system; determining according to a heuristic whether the request is a bulk data copy operation; detecting whether the request exceeds a threshold defining permitted data copy operations; and halting the request by the user in response to determining that the request is determined to be the bulk data copy operation and that the threshold is exceeded.