Departing employee data exfiltration: guidance sets out risks

What happened

Workers preparing to leave an organisation can remove sensitive information through access they are still authorised to use, NHI Mgmt Group says in online guidance updated on 25 September 2026.

The publisher’s glossary entry on departing employee data exfiltration describes the unauthorised removal of company information by someone who is resigning or preparing to leave. It is explanatory guidance, rather than reporting on a particular theft, arrest or court case.

The central distinction is between permission to access information for work and permission to retain it elsewhere. Someone may still be entitled to open a document during their notice period without being allowed to transfer it to a personal account.

The guidance identifies personal email, cloud storage, removable media, screenshots, printing and file synchronisation as possible routes. Collaborative systems that remain available during a departure can also allow information to be taken without an attempt to break into a network.

AI tools add another route, according to the publisher. Internal material can be turned into summaries, translations, code extracts or structured exports, allowing sensitive information to leave in a different form from the original document.

The background

The risk described in the entry concerns misuse of trusted access rather than an outside attacker overcoming security barriers. A departing worker may already know which systems hold valuable material and how to retrieve it, reducing the technical effort needed to remove it.

The amount copied is not the only measure of potential harm. A limited collection of customer records, technical designs or internal operating instructions can expose valuable information even when there is no large-scale download.

Timing is another factor. Access suitable for an employee’s normal duties may need to change once responsibilities are being handed over, while delays in the departure process can leave permissions active longer than intended.

The publisher says the possible consequences include loss of confidential documents, customer information, intellectual property and operational knowledge. Depending on the material involved, organisations may also face legal, contractual, regulatory or competitive consequences; the entry does not quantify those risks.

This focus on the period before departure also appears in earlier Forensic Discovery guidance on employee data theft controls. That guidance recommends early access checks, targeted monitoring and evidence preservation while respecting departing employees’ privacy.

Cloud collaboration and AI-assisted work broaden the issue beyond a single computer. The NHI Mgmt Group entry argues that controls need to consider the information being moved and the transfer itself, rather than concentrating only on the device used.

What people are saying

NHI Mgmt Group says organisations should look for unusually large downloads, unexpected sharing, repeated synchronisation and access to information stores outside an employee’s normal responsibilities. Copying from sensitive locations shortly before departure is another pattern it identifies for scrutiny.

The publisher frames the purpose of monitoring as distinguishing necessary handover work from copying intended to retain company information after employment ends. It recommends closer review of access to valuable material and clear rules on what employees may transfer into personal ownership.

Its governance advice calls for shared ownership of departure procedures, access reviews and data-loss monitoring. The entry says the risk spans human resources, IT, security and business teams, with slow handovers between them extending the opportunity for information to be removed.

The publisher also maps its recommendations to established security frameworks. These include the US National Institute of Standards and Technology’s SP 800-53 Revision 5 and Cybersecurity Framework 2.0, alongside the Center for Internet Security’s Controls v8.

Within those frameworks, it highlights least privilege — giving people only the access needed for their tasks — together with account management, management of login credentials and review of activity records. Its recommendations include restricting departing staff to transition work, promptly revoking or changing credentials, and checking records for abnormal transfers.

What happens next

The entry sets out practical recommendations rather than announcing an investigation, implementation timetable or forthcoming policy change. For employers applying it, the immediate decision is whether a worker’s permissions should be narrowed when their employment status changes, rather than left untouched until their final day.

An access review also needs to account for credentials, authentication tokens and active sessions. These are different ways a system can continue to recognise a user as authorised, and the guidance identifies their continued usability after departure as a source of exposure.

The distinction between closing a main account and ending all access is also addressed in earlier LeadingIT guidance on revoking former employee access. That report covers connected applications, shared files and company information on personal devices.

NHI Mgmt Group’s recommendations bring access restrictions and monitoring into the departure process itself. Their application depends on identifying what information remains necessary for the handover and which routes could allow it to be retained without authorisation.