Investigate a departing employee's privilege abuse, data exfiltration, and attempted log tampering, then choose a response that preserves the case
Derek Voss, a systems administrator at Ironvale Credit Union, submitted his resignation with the standard two-week notice. Days before his last day, IAM/PAM, database, endpoint, network, and Windows Event Log telemetry all show a coordinated privilege-escalation and data-exfiltration event, followed by an attempt to erase the evidence. Reconstruct what happened, determine how the cover-up was caught, and choose a response that preserves the case.
David Kess, a senior account manager at Thornbury Wealth Advisors, gives two weeks' notice on his way to a competing firm. In his final week, Microsoft 365 audit logs show a sudden spike in client-portfolio file access reaching well past his own client list, and a personal cloud-sync client appears on his laptop that same evening. Reconstruct what he took before HR could revoke access.
At Bellhaven Mutual Insurance, a fraud-analytics rule flags a run of small property claims that all disburse to the same bank account. Priya Nandakumar, a senior claims examiner with authority to approve claims under $7,500 without secondary review, has been quietly working outside her assigned queue for months. Reconstruct the collusion, the structuring pattern used to stay under oversight thresholds, and how far the fraud extends.
Marcus Delacroix, a senior firmware engineer at Fenwick Robotics, accepts an offer from a direct competitor, Ordinal Dynamics. In the final days before his notice period ends, source-control and endpoint telemetry show a mass repository clone, a personal GitHub remote added to a proprietary firmware repo, and an attempt to scrub the local evidence. Trace the theft from first clone to cover-up, and confirm what survived it.
Renata Cho, a senior account executive at Solstice Analytics, gives two weeks' notice on her way to a direct competitor, Northgate Metrics. In her final week, the Salesforce Setup Audit Trail shows a bulk report export reaching every account in the CRM, far beyond her assigned West-SMB territory, followed by a personal-email attachment and a sync to a personal cloud folder. Reconstruct what left the CRM before her access was cut.
Theo Bracewell, a cloud database administrator at Cascade Freight Systems, is placed on a performance improvement plan and quietly begins job-hunting. Two days before his manager delivers a termination decision, CloudTrail shows him sharing a production RDS snapshot to an AWS account outside the organization, then trying and failing to shut off logging. Reconstruct the exfiltration and explain why the cover-up attempt could not succeed.
At Northshore Regional Medical Center, a routine EHR privacy audit flags a nurse repeatedly viewing a patient's chart over three weeks, using a break-glass emergency-access reason each time. Deb Alvarez was never assigned to that patient's unit, and the patient is her ex-partner. Reconstruct the access pattern and determine whether this was treatment, curiosity, or something the hospital must report.
Colin Marsh, a senior network engineer at Wexford Industrial Systems, learns informally that his team is targeted in an upcoming reduction in force. Weeks later, a change-control audit finds a disguised scheduled task on the core jump host that checks whether his Active Directory account has been disabled, and if so, deletes backup repositories and disables switch management access. Trace the logic bomb from its planting to its trigger condition, and confirm whether it fired.
Ravi Sundaram, a senior machine-learning engineer at Solace AI, gives notice on his way to a direct competitor, Vantage Cognition. In his final week, the internal model-artifact registry shows him downloading the full production checkpoint for the company's flagship model, a file he has never pulled in its entirety before, followed by a sync tool appearing on his workstation and a large upload to a personal cloud bucket. Reconstruct what left the registry before his access was cut.
Nadia Okonkwo, a compliance analyst at Ridgeview Pharmaceuticals, files an ethics-hotline complaint alleging the CFO falsified expense reimbursements, attaching three supporting documents. Days later, mailbox audit logs show she forwarded far more than those three documents to her personal email, an entire case archive spanning over 200 unrelated HR investigations, salary reviews, and medical-accommodation records. Separate what she did that the law protects from what she did that the company must still address.