Insider Data Theft Guide: Detecting and Preventing Data Exfiltration by Insiders

Insider data theft is hard to stop because the person taking the data is already authenticated, already authorised and usually doing something that looks like their job. MFA, password policy and perimeter controls work as designed and still do not help, because nothing is broken into. This guide covers how insiders take data, where the risk concentrates (departing staff, privileged and support roles, bribed or recruited insiders, and third parties), the signals worth detecting, and the preventive controls that reduce the blast radius. It is written for security, data protection and insider risk practitioners who need a programme that finds theft early without turning into blanket surveillance of staff. The wider programme (governance, case management, HR and legal process) is covered in the Insider Threat Programme Guide; this page stays on the data theft problem itself.

Key takeaways

• Theft uses legitimate access. Insiders mostly exfiltrate through channels they are allowed to use: sync clients, browser uploads, email, USB, print and source code hosts, so detection has to look at volume, destination and context, not just authentication.
• The departure window is the highest-risk period. Resignations, terminations and notice periods should switch on closer monitoring and faster access removal, linked to an HR feed rather than a manual ticket.
• Least privilege limits what can be stolen. Support agents, engineers and administrators who can bulk-read records or code are the high-value targets for bribery and recruitment, as Coinbase found in 2025.
• Machine credentials outlive people. Signing keys, API tokens, SSH keys and personal access tokens a leaver could reach must be rotated, or a former employee keeps a door open, as the Coupang case showed.
• Proportionality is a design requirement. Monitoring has to be lawful, transparent and the least intrusive option that works; pseudonymised triage and a documented DPIA make the programme defensible and more trusted.

Who steals data and why: the insider profiles

CISA defines an insider as any person who has or had authorised access to or knowledge of an organisation's resources, and insider threat as the threat that an insider will use that access, wittingly or unwittingly, to do harm. CISA lists theft (of money or intellectual property) and espionage among the expressions of insider threat, and separates unintentional (negligent or accidental), intentional, collusive and third-party insiders. Each profile steals differently and needs a different control emphasis.

Fake hires who are themselves the threat, such as remote IT worker schemes, sit in a related category with their own detection approach. See the Insider Threat from Fake IT Workers Guide.

How insiders exfiltrate data: channels mapped to ATT&CK

MITRE ATT&CK was built around external adversaries, but its collection and exfiltration techniques describe insider behaviour well, and mapping to them lets detection engineers reuse existing analytics. The table lists the channels seen most often in insider cases.

Two channels have no clean technical telemetry: photographing a screen with a phone and printing. Printing can be logged and controlled; phone photography can only be made less valuable through field masking, watermarking and limiting how much a single user can display. For the network and tooling side of exfiltration by any actor, see the Data Exfiltration Guide.

The departure window: the highest-risk period

Departing employees are the most consistently reported source of intellectual property theft, because they have a clear motive (taking their work to a new role) and still hold full access during notice. Vendor insider risk tools build specific policy templates around this; Microsoft Purview Insider Risk Management, for example, has a "Data theft by departing users" template triggered by a resignation or termination date from an HR connector, or by account deletion in Microsoft Entra ID, and scores exfiltration indicators such as SharePoint downloads, printing and copying to personal cloud storage near those dates. The pattern is product-independent:

• Feed HR events automatically: resignation submitted, notice given, termination scheduled and last working day should arrive from the HR system as structured events, not emails. Without a feed the monitoring window starts after the data has gone.
• Look back as well as forward: theft often happens before the resignation is announced. When a departure event arrives, review the previous weeks of activity for the user against their own baseline.
• Tighten during notice: remove access to repositories and data not needed for handover, block removable media and personal cloud uploads for the user, and require approval for bulk exports.
• Revoke everything on the last day: SSO and directory accounts, sessions and refresh tokens, VPN, personal access tokens, SSH keys, API keys, OAuth grants to third-party apps and any shared secrets the person could read. See the Employee Offboarding Security Guide and the Joiner-Mover-Leaver Guide.
• Rotate what cannot be revoked: signing keys, service account passwords and shared credentials the leaver had access to. In the Coupang breach, an authentication engineer who left at the end of 2024 kept a token signing key that was never rotated, and used it to forge tokens and pull data on 33.7 million accounts over several months.

Movers often keep old access too (NIST SP 800-53 PS-5 Personnel Transfer).

Prevention: reduce what any single insider can take

Detection finds theft after it starts. Prevention limits how much one person can reach and how easily it leaves. The controls below are listed roughly in order of risk reduction per unit of effort.

1. Identify the crown jewels. Name the datasets whose theft would really hurt (customer PII, source code, designs, pricing, M&A material) and where they live. Classification makes every later control cheaper. See the Data Classification Guide.
2. Enforce least privilege and need-to-know. Review who can bulk-read each crown jewel dataset; remove standing access to production data for engineers; scope support agents to records linked to an open case (NIST SP 800-53 AC-6, CSF 2.0 PR.AA-05).
3. Mask and minimise in internal tools. Show the last four digits, not the full number; hide ID images unless the case needs them; cap the number of records a user can view or export per hour. This is the control that would have limited the Coinbase insider breach, where criminals paid overseas support agents to copy data on 69,461 customers using access their jobs already gave them.
4. Control egress channels. Endpoint DLP for USB, print, clipboard and browser uploads; a web gateway or CASB to block personal cloud tenants; email DLP for personal address forwarding. See the Endpoint DLP Guide and the Removable Media and USB Control Guide.
5. Use privileged access management for administrators. Just-in-time elevation, session recording and dual control for database exports and backup restores (see the PAM guidance linked below).
6. Keep secrets and keys out of reach. Signing keys belong in an HSM or managed key service with short lifetimes, not on developer laptops. Secrets belong in a vault with per-identity access and audit.
7. Use VDI or enterprise browsers for high-risk third parties. Offshore and outsourced teams handling sensitive records can work in a controlled session with copy, print and download disabled.
8. Watermark and fingerprint. Visible watermarks with the user's name deter screen photography; document fingerprinting and exact data match help DLP recognise your own data when it moves.

Detection: signals that separate theft from normal work

No single event proves theft. Effective detection combines a trigger (an HR event, a DLP alert, a tip-off) with deviations from the user's own baseline and the context of their role. Score and correlate; do not alert on every download.

Do not forget machine paths. Automated pulls through an API using a service account or a forged token (as at Coupang, where around 140 million automated requests went unnoticed for months) will not show up in user-centric analytics. Monitor API volume per credential and alert on credentials used from unexpected networks. See the Insider Threat and Identity Guide.

Measuring the programme

• Departure coverage: percentage of leavers whose HR event reached the monitoring tool before their last day (target close to 100%).
• Time to full revocation: hours from last working day to removal of all accounts, tokens and keys, including non-SSO applications.
• Bulk access exposure: number of users able to export each crown jewel dataset in bulk, trending down.
• Triage precision: proportion of escalated alerts confirmed as policy violations or theft; a low figure means the rules are noisy and analysts will start ignoring them.
• Time to contain: from first confirmed exfiltration signal to blocked access and preserved evidence.
• Egress control coverage: percentage of managed endpoints with DLP and device control in enforcement mode.

Privacy and proportionality

Insider data theft detection processes personal data about employees, and in the UK and EU it is subject to data protection law. The UK ICO's guidance on monitoring workers is clear on the main points: choose the least intrusive method that achieves a defined purpose; carry out a DPIA before high-risk monitoring (it names keystroke monitoring as an example); consent is usually not an appropriate lawful basis in employment, so legitimate interests with a documented three-part assessment is the normal route; tell workers about monitoring before it starts; and keep data no longer than necessary. Covert monitoring is limited to exceptional cases such as suspected criminal activity, must be authorised by senior management, time-limited and covered by a DPIA. The ICO notes its guidance is under review following the Data (Use and Access) Act, so check the current version.

• Pseudonymise triage: analysts see risk scores and activity, not names, until an alert meets a documented threshold for escalation.
• Separate duties: security detects, HR and legal decide; no single analyst can open a full investigation on a colleague alone.
• Collect metadata before content: file names, sizes and destinations are usually enough to triage; content inspection is reserved for sensitive data matches.
• Publish the rules: an acceptable use and monitoring notice that explains channels, purposes and retention increases deterrence as well as compliance.

See the Employee Monitoring and Privacy Guide for the legal detail.

Implementing an insider data theft capability

1. Scope and govern (weeks 1 to 4): agree crown jewel datasets, sponsors in security, HR, legal and privacy, the lawful basis and a DPIA. Write the escalation and investigation procedure before any alert fires. See the Insider Threat Programme Guide.
2. Wire in triggers (weeks 4 to 8): connect the HR feed (resignations, terminations, performance plans where policy allows) and the identity provider. Test with a synthetic leaver.
3. Collect telemetry in audit mode (weeks 6 to 12): endpoint DLP, SaaS audit logs, source control, email and web gateway. Build per-user baselines; do not block yet.
4. Tune with a pilot group: review alerts with HR and the business, record false positive causes and adjust thresholds. Aim for a triage precision the team can sustain.
5. Enforce on the clearest channels: block personal cloud uploads and unknown USB storage for crown jewel data first, with a warn-and-justify option for edge cases. Keep a documented rollback (switch a rule back to audit) and an exception process.
6. Close the offboarding loop: automate revocation of accounts and tokens, and add a key and secret rotation step for engineers and administrators.
7. Exercise: run a tabletop on a departing engineer and a bribed support agent, including evidence preservation and legal hold. See the Insider Data Theft Response Playbook.

Small vs large organisations: a small organisation gets most of the value from least privilege, an offboarding checklist that covers tokens and keys, blocking personal cloud uploads and reviewing downloads for every leaver. Dedicated insider risk platforms with behavioural scoring make sense once headcount, data volume or regulatory exposure means manual review of leavers no longer scales. If you are evaluating platforms, see the Insider Risk Management Buyer's Guide.

Common failure patterns

• Offboarding that stops at the directory account. Personal access tokens, SSH keys, OAuth grants and signing keys survive, and the former employee keeps working access. The Coupang breach is the clearest recent example.
• Trusting authentication as a control. Bribed agents at Coinbase used their own authenticated sessions; MFA worked and the data still left. Access scope and volume limits are the controls that matter.
• No HR feed. Security learns of a resignation from an email after the last day, by which time the look-back is the only option and access has not been tightened.
• Alerting on everything. Undifferentiated DLP alerts bury the real case; analysts stop looking. Correlate with triggers and baselines.
• Ignoring third parties. Outsourced and contractor staff often have broad access with weaker oversight and contracts that do not require prompt misuse reporting.

Lessons from incidents

• Collusive insiders (Coinbase, 2025): criminals recruited support agents to copy customer data and then demanded $20 million in extortion. Detection came from the extortion email, not an internal alert. Case-linked access and record volume analytics are the lessons.
• Departing engineer (Coupang, 2025): a retained signing key gave a former employee months of access. Rotate keys on departure and verify tokens against issuance records.
• Source code disclosure (Twitter, 2023): code published to GitHub by an insider was public for months and removed only through a DMCA takedown. Monitor for leaks externally as well as internally.
• Accidental loss (Samsung, 2023): staff pasted source code and meeting notes into a public AI chatbot. See the Samsung ChatGPT source code leak and the Generative AI Data Loss Prevention Guide.

Framework mapping

Practitioner checklist

• Name the crown jewel datasets and list who can bulk-read or export each one.
• Connect HR resignation and termination events to monitoring and access tightening automatically.
• Extend offboarding to tokens, SSH keys, OAuth grants and rotation of any keys or shared secrets the leaver could reach.
• Mask sensitive fields and cap export volumes in internal support and admin tools.
• Block personal cloud uploads and unknown removable storage for sensitive data, with a justified override path.
• Baseline per-user download and access volumes and alert on large deviations combined with a trigger.
• Monitor API volume per service account and token, not only per human user.
• Complete a DPIA, publish a monitoring notice and pseudonymise triage.
• Search public code hosts and paste sites for distinctive internal strings.
• Exercise the response with HR and legal, including evidence preservation.

Standards and references

• CISA: Defining Insider Threats
• CISA: Insider Threat Mitigation Guide
• Carnegie Mellon SEI: Common Sense Guide to Mitigating Insider Threats, Seventh Edition
• NIST: SP 800-53 Rev. 5
• MITRE ATT&CK: Exfiltration
• ICO: Data protection and monitoring workers
• Microsoft Learn: Insider risk management policy templates

Related NHI Mgmt Group resources: Insider Threat Programme Guide · Data Loss Prevention (DLP) Guide · Insider Threat and Identity Guide · Employee Monitoring and Privacy Guide · Insider Data Theft Response Playbook