Nearly 60 percent of departing employees make off with sensitive company information, study says

Tim Wilson, Editor in Chief, Dark Reading, Contributor

February 23, 2009

2 Min Read

More than half of all employees who lost or left their jobs last year took confidential company data with them, according to a study published today.

According to a study released by the Ponemon Institute and Symantec, 59 percent of ex-employees admitted to stealing confidential company information. The most commonly taken data included e-mail lists, employee records, customer information, and nonfinancial information.

Fifty-three percent of respondents downloaded information onto a CD or DVD, 42 percent onto a USB drive, and 38 percent sent attachments to a personal e-mail account, the study says. Seventy-nine percent of respondents said they took the data without their employer's permission.

Officials at both Ponemon and Symantec say they expect the trend to continue, if not worsen, as the economy deteriorates and layoffs increase. "If your organization is planning a RIF [reduction in force], you need to understand the attitudes of the people who are being let go," says Michael Spinney, an analyst at Ponemon Institute. "Once they've lost their jobs, they feel like they don't really have a lot to lose."

Legally, corporations could take action against terminated employees who make off with sensitive data, but "most enterprises aren't interested in suing people -- they just want to protect the data and keep it from getting out," says Kevin Rowney, founder of the data loss prevention (DLP) unit of Symantec, formerly known as Vontu.

Rowney believes the egress of data via terminated employees is mostly preventable. "Most employees who've lost their jobs aren't sneaking the data out in sophisticated ways," he observes. "They're emailing it to themselves or carrying it out on a USB memory stick. These are the kinds of things that a good DLP solution can stop."

Spinney notes that many IT organizations still aren't following common-sense best practices when employees leave their companies. "Twenty-four percent of respondents said they still had access to their employer's computer system or network after they left the company," he says. "Cutting off that sort of access should be a no-brainer for most IT departments."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message

About the Author(s)

Tim Wilson, Editor in Chief, Dark Reading


Tim Wilson is Editor in Chief and co-founder of Dark, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one of the top cyber security journalists in the US in voting among his peers, conducted by the SANS Institute. In 2011 he was named one of the 50 Most Powerful Voices in Security by SYS-CON Media.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights