INSIDER THREATS
A former employee took data or customers: how to investigate and prove it
Insider threats leave traces in email, cloud and devices. See the signs, how to preserve evidence, what may be investigated and the possible employment, civil and criminal actions.
IN 30 SECONDS
- Don't wipe or reassign the former employee's computer.
- Email, cloud and device logs show what left and when.
- Personal accounts only with consent or a court order.
- A technical and legal report supports dismissal for cause, lawsuits and criminal complaints.
A manager resigns and, weeks later, shows up at a competitor serving your best customers. Or a pricing spreadsheet starts circulating outside the company. Insider threats are among the hardest incidents to handle, because they involve someone who had legitimate access. The good news: that access leaves records. The difference between a suspicion and a solid case lies in how those records are preserved and analyzed.
Common signs
- Unusual downloads
Large volumes of files downloaded or synced in the weeks before leaving. - Forwarding to personal email
Messages, contracts and customer lists sent to private accounts. - USB drives and personal cloud
Use of USB devices or storage services the company doesn’t use. - Access at odd hours
Logins at night, on weekends or after notice was given. - Customers being approached
Customers report contact from the former employee or a new company.
First of all: don’t wipe the computer
The most common mistake is handing the former employee’s laptop to someone else or reinstalling the system. That erases the evidence. Keep the device, preserve the accounts and call in the investigation.
How to investigate and prove it
- Preservation
Forensic imaging of corporate devices and collection of email, cloud, VPN and system logs, with hashes and chain of custody. - Timeline
We cross-reference access, downloads, transfers and connections to show what left, when and by which route. - External context
Open-source investigation of the new company, its partners, domains and approaches to customers. - Technical and legal report
A document that supports employment, civil and criminal action.
Possible actions
| Area | Action |
|---|---|
| Employment | Dismissal for cause for breach of trade secrets or competition (Brazilian Labor Code, art. 482) |
| Civil | Urgent injunction to stop use of the information and damages |
| Criminal | Unfair competition crime for using or disclosing confidential information (Law 9,279/96, art. 195) |
| Providers | Court order for access logs (Brazil’s Internet Civil Framework, art. 22) |
| LGPD | Assess notifying the ANPD and data subjects if customer personal data was involved |
What may be investigated
The company may analyze corporate devices and accounts, ideally under a usage policy that makes this clear. The employee’s personal accounts and devices may only be accessed with consent or a court order. Evidence obtained improperly can be thrown out and may even create liability for the company.
Prevention
- Access revoked on the day of departure
- Confidentiality agreement signed and device usage policy in place
- Least-privilege access to sensitive data
- Alerts for mass downloads and forwarding to personal email
- Internal investigation plan agreed with the legal team
Written with the collaboration of Sabrina Gomes, CLO at Gestão de TI.
HOW GESTÃO DE TI CAN HELP
Audit, Compliance & Data Protection
Insider threat investigations with forensic preservation, a timeline and a technical and legal opinion.
For information only. This does not replace a professional review of your specific case. Legal references reflect the rules in force on the publication date (Brazilian law).