Miller Group sets out data theft safeguards for departing staff

What happened

The Miller Group published online guidance on 29 July 2024 urging employers to address data theft risks when staff leave, whether through resignation or dismissal.

The company’s article, the source of this report, identifies customer information, financial records and intellectual property as material that departing employees could take. It describes potential consequences including lost business, legal disputes, regulatory penalties and damage to an organisation’s reputation.

This is preventive guidance rather than an account of a particular incident. It does not report an arrest, court ruling or measured increase in employee data theft.

The article lists several activities that employers should examine, including unusually large downloads, repeated access to business information and requests for material unrelated to an employee’s duties. Access at unexpected times is another potential warning sign, according to the guidance.

It also highlights personal file-sharing services, unauthorised devices, searches for ways around security controls and attempts to persuade colleagues to provide access to their information. Recording meetings or taking screenshots features among its examples.

These are indicators for assessment, not findings that an employee has stolen information. Their significance depends on the work being done and the organisation’s rules; the article does not provide a test for establishing wrongdoing from any single behaviour.

The background

The guidance distinguishes deliberate misuse from mistakes. The Miller Group says most departing employees are not acting maliciously: some misunderstand who owns work-related information, while others leave business files on devices without realising they should remove them.

That distinction matters because data can become exposed without a deliberate attempt to steal it. The article also describes former employees inadvertently sharing sensitive material through insecure channels.

Where conduct is intentional, the publisher identifies several possible motives. An employee might use confidential knowledge to obtain another job, benefit a competitor, sell information or establish a business of their own.

Resentment over a departure is another risk described in the article. In that situation, the harm may involve destroying information and disrupting operations rather than copying files for later use.

The term data exfiltration refers to moving information out of a system without authorisation. For employers, the practical issue is both whether someone retains access and whether business information has already been transferred elsewhere.

That second issue also appears in LeadingIT’s guidance on removing former employees’ access, which says closing a main account does not resolve exposure through connected applications, shared files or company information on personal devices.

What people are saying

The Miller Group recommends written rules that distinguish permitted personal use from business use of information, equipment and networks. It says those rules should also explain how information is made available to employees when they join, during employment and when they leave.

The article, attributed to the company’s director of HR, Laura Miller Forbes, calls for a named person to oversee insider-risk prevention. It assigns that person responsibility for keeping the programme current, organising staff training and maintaining a plan for responding to incidents.

The publisher advises employers to plan on the possibility that a departing worker could still reach sensitive information after leaving. It recommends tools that preserve an audit trail — a record of activity that can be examined if a concern arises.

It also warns that technical systems designed to prevent data loss cannot stop every unauthorised transfer. Its guidance therefore calls for policies to be revised and procedures to be tested regularly, rather than treating the installation of security software as a complete solution.

What happens next

The article sets out continuing measures for employers, not a scheduled investigation or forthcoming legal decision. Its operational recommendation is for HR and IT teams to communicate promptly during offboarding, the process of ending an employee’s working relationship and access to company resources.

The Miller Group says equipment should be recovered promptly after access to information is restricted. It acknowledges that departures differ, making communication between departments important rather than prescribing an identical response for every employee.

The emphasis on shared responsibility is consistent with CISA’s guidance on building insider threat management teams. The US cybersecurity agency recommends involving security, HR, legal and operational specialists, alongside protections for sensitive employee information.

The Miller Group provides no evidence measuring how much its six recommended strategies reduce theft. Its article is a framework for organising preventive work, rather than a guarantee that any particular control will prevent a loss.