The Concern
A technology firm had spent nearly two years building a new product, and its design and architecture were central to its competitive edge. Read More
What We Did
Reviewed access records for the firm’s design repositories, document systems and shared drives to find who had accessed the affected files, and when. Read More
What We Found
A senior employee had accessed and downloaded large volumes of design files in the weeks before resigning, well beyond what their role at the time required. Read More
The Outcome
Leadership got a clear, evidence-backed account of how the information left the organisation and who was responsible. Read More
The Concern
A technology firm had spent nearly two years building a new product, and its design and architecture were central to its competitive edge. Weeks before its own planned launch, a competitor released a product with strikingly similar features, design elements and technical approach. The resemblance was too close to be a coincidence, and leadership needed to know how it had happened.
The firm’s first assumption was an external cyberattack. The IT and security teams reviewed firewalls, network logs and system alerts, but found no sign of intrusion, malware or unauthorised external access. With no evidence of a breach from outside, attention shifted to an uncomfortable possibility: the information may have left through someone who already had legitimate access.
That made the situation especially delicate. The product team was made up of trusted senior people, and a visible inquiry risked damaging morale, triggering exits and alerting anyone involved. Leadership also knew that any legal action against an individual or a competitor would rely on evidence gathered lawfully and documented properly. They needed an independent, confidential investigation that could establish the facts without disrupting the business or weakening its legal position.
What We Did
- Reviewed access records for the firm’s design repositories, document systems and shared drives to find who had accessed the affected files, and when
- Conducted a forensic review of company-owned devices and accounts within the firm’s policies and applicable law, to find unusual downloads, transfers or file activity
- Mapped the timeline of employee exits and role changes against the competitor’s development and launch schedule
- Ran professional background and relationship checks to identify any links between former employees and the competitor
- Conducted structured interviews with relevant team members and documented every finding to an evidentiary standard to support legal proceedings
What We Found
- A senior employee had accessed and downloaded large volumes of design files in the weeks before resigning, well beyond what their role at the time required
- Files had been moved to personal storage through channels that the firm’s controls didn’t monitor
- The employee had joined the competitor shortly after resigning, in a role directly tied to the product launch
- Exit procedures did not include an access review or any check on recent data activity, so the transfers went unnoticed
- Access permissions were broad and rarely reviewed, so senior staff could reach sensitive files that had nothing to do with their current work
The Outcome
- Leadership got a clear, evidence-backed account of how the information left the organisation and who was responsible
- The firm started legal proceedings to protect its intellectual property, supported by properly documented evidence
- Injunctive relief was pursued to limit further use of the misappropriated designs
- Access controls were restructured on a need-to-know basis, with regular permission reviews for sensitive repositories
- Exit procedures were strengthened to include data activity reviews, access revocation and formal confidentiality reminders for departing staff