Covert Data Exfiltration by Departing Senior Employee

Situation: A financial services firm suspected a departing director had exfiltrated a client database and confidential pricing models to a competitor. The director had resigned with one week’s notice and started at a competitor ten days later. IT had seized the laptop but lacked forensic capability.

Investigation: Binary Response conducted forensic examination of the laptop and M365 account. We identified over 4,000 documents accessed in the 72 hours before resignation, with 847 uploaded to a personal OneDrive account. Network logs confirmed large data transfers to a personal cloud storage service. We also identified a personal USB drive had been connected on the final day in the office, with evidence of file copying.

Outcome: Expert witness report produced for High Court injunction proceedings. Emergency injunction granted within 48 hours, requiring the former employee to preserve and return all company data. The evidence package was provided to the firm’s employment lawyers for ongoing litigation. A financial settlement was reached before trial.

Discuss Your Situation

Every engagement is different. Contact us to discuss your specific situation — whether you're dealing with an active incident or planning ahead.