Case: IP Theft Investigation — trade secrets taken by a departing senior engineer
Incident: a senior ML engineer (3.5 years with the company) resigned and two weeks later announced 'his own' product with an identical architecture and model weights.
AgentD22 Data solutions digital forensics:
- Endpoint logs (CrowdStrike/EDR): file operations, USB devices, cloud sync clients
- Git and GitHub audit logs: clones, pushes, downloads, personal access tokens
- Google Drive and OneDrive: export logs, sharing history, download timestamps
- Email and Slack: attachments, forwards to personal accounts
- Network: DNS queries to competitor domains, VPN logs
Evidence of exfiltration:
- 47 private repositories cloned in the 3 days before resignation (an admin-level token)
- 2.3 TB exported from Google Drive (models, datasets, experiments) — 12 hours before leaving
- 15 archives sent to a personal email (ProtonMail) over encrypted channels
- The competitor's domain registered a week before resignation (WHOIS history)
Outcome:
- A Temporary Restraining Order obtained in the Delaware court within 48 hours
- Obligation to destroy copies, third-party audit, damages of 2M
- The engineer and the new employer signed a settlement with NDA and non-compete terms
- DLP (Forcepoint), GitHub Enterprise DLP and CASB introduced to prevent recurrence
← Back to news