Information Governance & Data Privacy Consulting

Departing Employee Data Theft Consulting

J.S. Held’s Inaugural Global Risk Report Examines Potential Business Risks & Opportunities in 2024

Read More close Created with Sketch.

We deliver expertise in developing proactive employee departure protocols and provide guidance in data proliferation response and remediation.

Our experts in digital forensics, data privacy, and information governance deliver strategic advisory regarding the implementation and/or enhancement of departing employee procedures, monitor and flag potential indicators of risk, preserve and analyze sensitive data accessed by departing employees, and deliver defensible remediation services in cases of data flight.

Our Services
  • Best Practice Policy Development
  • Compliance & Regulatory Program Implementation / Enhancement
  • Data Analysis – External Transfers, Document Access, Deletion Activity, Software-Specific
  • Data Privacy & Security Protocols Implementation / Enhancement
  • Data Proliferation & Flight Prevention
  • Document Recovery
  • “Near-Duplicate” Document Assessment
  • On-Premises Index & Search
  • Recovered Document Purge / Transfer
  • Source Data Preservation
  • Timeline Development & Analysis
Our Professionals
  • Certified CISO – Chief Information Security Officer
  • CIPM – Certified Information Privacy Managers
  • CIPP – Certified Information Privacy Professional
  • CISM – Certified Information Security Managers
  • CISSP – Certified Information Systems Security Practitioners
  • Compliance, Sanctions & Regulatory Experts
  • Cyber Security & Investigations Experts
  • Data Analysts
  • Digital Forensics Experts
  • Equipment Consultants
  • Former Federal Law Enforcement Agents
  • Former Prosecutors & Attorneys
  • IAPP – International Association of Privacy Professionals
  • Network Security Experts
  • Risk Advisory & Compliance Experts
  • Technology Consultants
Proactive Measures

We have significant experience assisting organizations and law firms operating on behalf of organizations in proactive measures, such as drafting best practice policies, incorporating aspects of data privacy and/or security protocols where warranted, or offering recommendations to minimize unwanted data flight. Our team works closely with internal stakeholders to understand existing policies and procedures, which help to formulate newly-created recommendations and guidelines or enhance existing procedures to adhere to industry-specific compliance or regulatory requirements.

Responsive Services

In situations when data flight has been discovered, our global team of data preservation experts are deployed to ensure source data is defensibly preserved with the appropriate chain of custody and related documentation. Our examination quickly identifies inappropriate data access, transfers, copies, and/or deletions. Subsequent analysis may include:

  • Identifying potential data transfer to external media - USB devices, thumb drives, cloud applications, and attachments to personal webmail messages, as well as sensitive or proprietary information sent via chat communications or saved locally to mobile devices
  • Analyzing system registry, event logs, and other related artifacts including recently accessed documents and/or “link” files
  • Deletion activity that may indicate efforts to obfuscate data transfers
  • Analyzing installed software and/or applications, particularly wiping tool applications
  • Deeper-dive document recovery from unallocated and/or slack space
  • Timeline and other analysis of specific application activity
  • Source code analysis to identify indications of source code theft or plagiarism of proprietary code
  • Use of advanced analytics, eDiscovery platforms, and tools such as large-language models, to inform more complex investigations

Depending on our analysis, our services include remediation efforts to identify the extent of data proliferation to outside parties. Based on the scale, this process may include the implementation of on-premise indexing and searching, as well as the assessment of “near-duplicate” documents to aid in identifying IP/trade secrets. Once identified, exfiltrated data can be defensibly purged or securely transferred back to our clients, utilizing a combination of automated and custom methodologies.

Featured Engagement:
Large-Scale Remediation Engagement Involving a Tech Start-Up

As part of a settlement agreement, our team developed a workflow that involved in-place searching of network file servers for specific data types based on key metadata attributes and related criteria using custom scripting tools. We followed this process with targeted defensible purging and quarantine of select documents, including identifying and remedying documents residing within email systems and related archives.

Featured Engagement:
IP Theft Investigation Involving a Fintech Firm

Coordination with client IT to perform surreptitious remote data preservation of electronic records, including data captures after normal business hours. The analysis uncovered evidence to support the client’s allegations of unauthorized and fraudulent data transfers. Key findings included confidential documents retrieved from an iPad’s hidden Dropbox backup directory and the match of metadata attributes with other recovered artifacts.

Featured Engagement:
Trade Secrets Theft Investigation Involving a Life Sciences Company

Oversaw efforts for a Puerto Rico-based client that revealed the transfer of stolen trade secrets and intellectual property, uncovered by matching web-server log entries with internet-browsing activity on suspect computers, among other findings.

Featured Engagement:
Allegation of Data Exfiltration Involving a Financial Services Company

Our digital forensics expert analyzed data flight and threat-actor activities in an IT infrastructure environment while performing live memory capture and analysis via Volatility. Findings revealed that remote login sessions and document transfers by unauthorized international users. Security measures were recommended and implemented to ensure the environment avoids additional data flight, among other remediation steps taken.

Related Insights

Our insights cover a variety of topics impacting businesses, society, the economy, and the environment. Check out our latest white papers, research reports, educational seminars, industry speaking engagements, and perspective articles.

Keep up with the latest research and announcements from our team.
Our Experts