As subject. I work in Information Security and am wondering how prevalent data theft is when colleagues leave a company. Anyone want to scare me half to death? Or are you all angels?

29 comments
  1. I’m an angel. I take informal notes of things that may be beneficial in my future career.

    As an infosec person, you ought to employ some software that detects data theft.

  2. No angel but not very criminal! I have on occasion taken complex spreadsheets, presentations and documents that took a lot of effort to set up but any sensitive info is removed or anonymised. Empty sheets with complex formulae, presentations of processes not company specific or similar types of documents. I don’t work in sales or finance so most of the data and info is not sensitive or necessarily proprietary.

  3. Anyone who is working notice is monitored for this at work. And I’d never do it, not worth the risk.

  4. I work in insurance and it is fairly common to come across physical copies of commercially useful documents or presentations from other companies that people have brought with them when they moved jobs. Thing is the information typically goes out of date quite quickly so isn’t of too much use.

    I don’t see instances of digital data being taken but this is probably because of tight controls related to GDPR. A previous member of my team sent lots of documents and commercially sensitive data to her personal email before leaving. She got a note from the company lawyers within a week of it happening demanding that she to delete all data and information.

  5. The last job I left, I was responsible for all the filing in my department, I just kept telling everyone it was done when actually I was just emptying my “to-do” pile into the confidential waste bin every Friday afternoon because nobody was checking. My annual reviews all read “exemplary time management” and whenever someone asked for some piece of information they’d usually get from the filing, I’d just make it up. Nobody ever knew.

    My little data protection parting gift is them realising that I destroyed everything for years because I couldn’t be bothered to walk upstairs.

  6. I take all my code but will probably never look at it again. Company data is useless to me so I don’t take that. Our infosec team jump on us if we download from our company onedrive to our personal computers.

  7. I’ll take a copy of useful bits of code but no data.

    A sales exec resigned then during his notice period tried swipe a copy of the entire database.

    Sacked on the spot

  8. I worked it in IT support and had the passwords and access to everything at most of the companies I worked for. I only ever took the personal bits from my home drive when I left.

    I worked with a guy who took an entire physical server with him (and bragged about it) when he left his previous job, but he was a prick of the highest order and ended up getting arrested so…

  9. No. There was a bunch of stuff that would have been really useful – excel insolvency calculators and such like – but I didn’t trust them not to check my outgoing emails and pursue me for intellectual property theft, even though they were stuff I’d created

  10. I know someone who recently handed their notice in to work for a competitor, and his company were too stupid to put him on garden leave.

    ​

    So of course he used this time to advise his clients he was moving elsewhere and did barely anything else. He thinks they may have thought he was just handing his notice in to get a pay rise and bluffing about the new job, but he wasn’t.

  11. I only forward myself emails that I might need access to, to cover my arse. For example when I was threatened with redundancy and they were doing a stupid skills matrix to see who stayed. So I forwarded things like my performance reviews to prove I was good at my job. Because I assumed as soon as my contract was terminated I’d lose access to the emails so would struggle to be able to use them in an appeal.

    I would also forward things like occupational health reports to my personal emails or access works emails from home and download them. My employer had put my works email on the referral so the reports etc were sent to my works email address.

  12. My entire inbox and all business contacts.

    There were numerous emails that could put the company in bad light and would cause stock prices to crash.

    I still have them and if they ever screw me over for a reference then off they go into the public

    It helps that they are an American company that loves screwing over its not American employees

  13. Everyone I know in rail engineering has copies of each others stuff, it’s basically expected that you’ll leave with a hard drive with your projects on it although there’s usually an effort to copy it discretely (i.e. keep your personal drive backed up regularly so that you don’t spend your notice period downloading the whole drive).

    At the last place I worked however, one chap just went to our IT guy and bribed him for some portable drives (I think it set him back about 8l of Pepsi Max) and spent his entire notice period booking holidays on one screen and openly copying the entire network drive on the other.

  14. I worked as a trainer at a call centre, was fucked over by my manager when I was sectioned, put on phones (a job I never did for that company) and pay decrease, HR didn’t care.

    So just before I left, I deleted every single training material they had and locked any spreadsheets via password protect.

    Any concerns they had about an employee during training were also deleted.

  15. Yes, with caveats. I wouldn’t take anything that contained personal or confidential information. But I might take certain documents which are transferable between companies. Things like policies and operating procedures. Particularly if I wrote them in the first place.

    And I wouldn’t take them as I was leaving. I would tend to have had my own, unbranded copies anyway.

  16. Discovered I still have access to 20-30% of to the old company’s drive which they don’t seem to care too much about. I use specific non-sensitive reports as quick references every now and again to verify data inputs etc. This is from small startup to larger engineering company in a different sector.

    I have downloaded academic sources I got access to through work and keep them.

    This doesn’t make me look good does it?

  17. I have always worked in public sector data. I don’t think I have ever taken data on purpose. I have by accident. I do make sure I take any clever bits of formula or code I come across. And sometimes I steal copies of things we produce because I thought they were a good idea.

    The only time I got caught and reprimanded is when I moved London local authorities and tried to circumvent security waiting for new access to third party systems, by using my old passwords from my old role.

  18. No, that’s criminal.

    What you fishing for here?

    No doubt you could be stalking profiles of people who say they have, and find the company they work for by data mining. Then use that to introduce yourself to said company to flog your services.

    You are not ‘just interested’, you are lokking for leads.

  19. Shedloads of stationary and – completely by accident – some sensitive documents. They went onto the wood burner.

    Also found a set of keys for the office in an old jacket pocket, but fuck ‘em.

  20. In the weeks leading up to my notice going in I’ll copy any relevant info I need onto usb sticks and remove them from work environs before my notice goes in.
    All my menus, costing spreadsheets, recipes, email contacts etc.

  21. My company takes data theft seriously. We’ve taken legal action several times in the last few years. Usually sales people taking copies of customer lists to their next role, but some people just take data sets and try to flog them.

  22. The iso images I created went with me. It took over a day to configure each machine one by one.
    There were 150 machines.

  23. No. The only stuff I “take” with me are my own personnel docs, like payslips, p60s etc.

    In my industry, putting aside the obvious trust / theft angle, it’s also treated as a serious breach of competition law and would likely get me at least a disciplinary, if not dismissed, at any new place of work.

    I assumed this was the case in all industries, but suspect some don’t take it as seriously as others.

Leave a Reply
You May Also Like