California law firm outlines response to former employee data theft

What happened

The Law Offices of David H. Schwartz, Inc., a firm serving California’s San Francisco Bay Area, published guidance on 17 March 2026 on responding to suspected data theft by former employees.

The firm’s article describes containment measures and possible legal claims. It is general business litigation guidance, not a report of a particular theft, arrest or court judgment.

Its first recommendation is to withdraw the former employee’s access to email, company networks and cloud services. The firm also advises checking active accounts for unauthorised routes into systems that may have been created before the employee left.

Businesses should then establish which information may have been taken. The article identifies customer records, financial information, software source code and marketing plans as examples whose loss could require different assessments of the potential harm.

Preserving evidence is another early priority. According to the firm, relevant material can include emails, server activity records and physical documents connected with the suspected theft.

The guidance also recommends examining employment contracts, non-disclosure agreements and other confidentiality commitments. These documents may establish what the former employee was permitted to do with company information and provide grounds for a contractual claim.

The background

The article distinguishes three possible civil claims: breach of contract, misuse of trade secrets and breach of fiduciary duty. These address different obligations, so the appropriate legal route depends on the information involved and the employee’s responsibilities.

A contractual claim concerns a broken agreement. The firm explains that employment contracts and non-disclosure agreements may prohibit staff from taking or using confidential material outside their work duties.

Trade secret protection involves a separate test. Under the California Uniform Trade Secrets Act, known as CUTSA, information must have economic value because it is not generally known, and its owner must have taken reasonable measures to keep it secret.

That distinction means describing a document as confidential is not, on its own, the test set out in the guidance. The business’s handling of the information matters, including whether access was restricted and confidentiality obligations were imposed.

The article gives formulas, customer lists and business strategies as examples of information that may qualify for protection. Their inclusion is not a finding that every document in those categories is a trade secret; the statutory conditions still apply.

A fiduciary duty is an obligation to act in another party’s interests. According to the firm, some employees, particularly executives and managers, owe such duties to their companies, creating another potential basis for action when they take confidential information.

The guidance also points to California Penal Code Section 502. It says knowingly accessing computer data and taking, copying or using it without permission can expose a former employee to criminal charges, with possible fines or imprisonment. Those are potential consequences, not outcomes reported in this article.

The commercial risks have parallels in other reporting. In a separate case, US prosecutors alleged that a trader took confidential code and predictive formulas to help establish his own trading business. That case concerns allegations against a named individual; the California firm’s article does not identify any accused employee.

The response also spans more than technical security. Earlier CISA guidance on insider threat management teams recommends bringing together security, human resources, legal and operational expertise, while protecting sensitive employee information.

What people are saying

The law firm says businesses pursuing a claim can seek a court order preventing further use of the information, the return of the material and financial compensation for harm caused.

For trade secret claims, it says recoverable damages can include the company’s actual losses and benefits improperly obtained by the former employee. It adds that deliberate and malicious misconduct may allow additional damages and recovery of legal fees.

The publisher identifies several possible measures of financial harm: profits lost when a former employee uses a customer list to take business, expenditure on developing the information and costs associated with repairing the security breach. It says assessing those amounts accurately can require detailed financial analysis.

What happens next

The article announces no pending proceedings or scheduled hearing. For an organisation applying the guidance, the next stage is to establish what the evidence supports rather than assume that suspected loss of information proves theft.

The firm describes three areas a company must substantiate when building its case: the protected nature of the information, evidence that the former employee took it and the resulting harm. Each requires a different part of the organisation’s records.

For the first, the article points to password controls, limits on who could access the material and signed confidentiality agreements. These records help demonstrate how the business treated the information before the dispute arose.

For the second, digital forensics — the examination of devices and electronic records — can help reconstruct activity. The firm says investigators may examine computer drives, servers and email accounts for transfers to personal email addresses, USB storage devices or cloud services.

For the financial claim, the business must connect the alleged theft with the losses it seeks to recover. The article presents this as an evidential task, not an automatic consequence of discovering that files have been copied.