The Concern
A Bengaluru-based technology services company provided software development and support to enterprise clients in India and abroad. Read More
What We Did
Scoped the inquiry. With leadership and legal counsel, we set out the timeline, identified the information that appeared to be compromised, and decided which devices, accounts and systems were relevant. Read More
What We Found
The evidence did not support the initial assumption. Read More
The Outcome
The company acted on verified evidence rather than assumption. Read More
The Concern
A Bengaluru-based technology services company provided software development and support to enterprise clients in India and abroad. It had around 600 employees and a client base built over a decade.
In a short space of time, two long-standing clients moved their contracts to a newly formed competitor. Feedback from one client suggested that the competitor’s proposal closely matched the company’s own pricing structure, project approach and even internal team details.
The competitor had recently hired a senior sales executive who left the company a few weeks earlier, and many people inside assumed he was responsible. Leadership was ready to take legal action. Its counsel, however, advised that any action had to rest on verified evidence, not circumstance. The company needed to know exactly what had left the organisation, how it had left, and who was involved.
What We Did
- Scoped the inquiry. With leadership and legal counsel, we set out the timeline, identified the information that appeared to be compromised, and decided which devices, accounts and systems were relevant.
- Preserved the evidence. Company-owned laptops, email accounts, cloud storage and access logs linked to the inquiry were secured and forensically imaged, so the evidence stayed intact and unaltered.
- Examined the digital trail. We reviewed file activity on company devices, email forwarding and sharing permissions, cloud and system access logs, and active, dormant and former-employee accounts.
- Stayed within authorised scope. All work was carried out on company-owned systems and data, within the scope authorised by the client and its legal counsel.
- Reconstructed the sequence of events. We established what data was accessed, when, from where and by whom, and separated routine business activity from activity with no legitimate purpose.
What We Found
The evidence did not support the initial assumption.
- The suspected executive hadn’t taken the data. His device and account activity in his final weeks matched a normal handover, with no unusual downloads, transfers or forwarding.
- The data left through a mid-level employee. A pre-sales manager who was still at the company had downloaded proposal documents, pricing models and client contact files, and shared them to a personal cloud storage account over several weeks.
- A former employee’s account was still active. The account of someone who had left months earlier had never been deactivated. During the same period, it was used to access the shared proposal repository.
- The activity was linked. Login records, timings and shared-file activity connected the dormant account to the pre-sales manager, who had been in contact with the new competitor.
These findings changed both the direction of the company’s response and the basis for it.
The Outcome
The company acted on verified evidence rather than assumption:
- Evidence for legal action: Legal counsel received a documented forensic report with full chain-of-custody records to support proceedings against the parties involved.
- A wrongful accusation avoided: The planned action against the former sales executive was dropped, which avoided unfounded allegations and the reputational and legal risks that would have come with them.
- Insider addressed: The pre-sales manager lost systems access and was placed under the company’s disciplinary process.
- Dormant accounts closed: All dormant and former-employee accounts were reviewed and deactivated.
- Controls strengthened: The company introduced stricter offboarding, restrictions on personal cloud uploads, and alerts for unusual data downloads.
The company regained control of its sensitive information and closed the gaps that had allowed the leak.