Departing and Disgruntled Employees

When organizations plan for insider risk, they usually focus on current employees, although some of the more costly incidents involve people who are about to leave or have already gone. A departing employee may still have corporate proprietary material from their role, and someone who leaves on bad terms may hold onto a grievance that motivates them to use that information months later. This week's MMR looks at how that risk develops and at the steps that can reduce it.

Access That Outlasts Employment

Most large organizations have an offboarding checklist, but accounts that sit outside the main network, such as cloud services and shared logins, are often left off those lists. In one well-documented case, a former Cisco engineer used his remaining access to the company's cloud environment in 2018, about five months after resigning, and deleted hundreds of virtual servers. More than 16,000 customer accounts were shut down for up to two weeks as a result.

The same gaps can appear with physical access when an employee's key card is not deactivated or a gate code they knew is left unchanged. At remote or unstaffed facilities, where nobody may be on hand to notice an unexpected visitor, a lapse like this can go undetected for some time.

Risk Before the Exit

In the weeks before a departure, staff who have resigned or expect to be let go generally still have full access, and some start collecting material before they leave. The Desjardins breach remains the largest Canadian example of how long this can continue without being noticed. Over at least 26 months, a marketing employee copied the personal information of close to 9.7 million people from a shared drive onto USB keys. The Office of the Privacy Commissioner of Canada found in 2020 that Desjardins' monitoring was largely passive, and the company only learned of the theft from the Laval police during a separate investigation.

When a Grievance Goes Public

When former employees post complaints online, the result is usually reputational harm with little security impact. However, that risk can grow when a grievance is paired with internal information. In a 2025 decision, the Ontario Superior Court of Justice granted an injunction to a cleaning services company against a worker it had terminated without cause in April 2024. The court found he had downloaded his entire work drive, including a staff directory and client financial details, and had sent confidential information and anonymous disparaging emails to the company's clients. He had also repeatedly contacted his former manager using at least eight different phone numbers. The court rejected his claim to be a whistleblower, finding the timing more consistent with retaliation.

Behaviour like this is often preceded by concerning statements to former colleagues or online, which can give an organization early warning of a potential incident once the employee has left.

What This Means for Organizations

Organizations can address much of this risk with controls they likely already have, provided those controls are applied to every departure. Access should be removed on the employee's last day, or at the time of notice for an involuntary termination, and that removal should extend to cloud services and physical credentials as well as the main network login. Any shared passwords or gate codes the employee knew should also be changed. For terminations that follow a dispute or disciplinary process, involving security in the planning before the meeting allows the organization to decide in advance how the employee will leave the site and which staff need to know.

The Role of Digital Investigative Intelligence

Digital investigative intelligence allows an organization to see what a former employee is saying publicly after they leave. Following a higher-risk departure, monitoring open sources can identify posts that disclose internal information or suggest an intent to cause harm, and the same techniques can show whether company documents have surfaced online. This gives security and human resources teams a factual basis for deciding whether to respond while the issue is still manageable. Any monitoring of this kind should be proportionate to the risk and limited to publicly available information.

Conclusion

Most employee departures happen without incident, and problems tend to arise in the smaller number of cases where access is left in place or warning signs are missed. The Desjardins and Ontario cases show that these gaps can take months or years to come to light. Treating offboarding as part of the security program, with access removed on time and higher-risk exits planned in advance, can address most of this risk without significant new investment.

About 3Si Risk Strategies

3Si provides security and emergency management consulting, threat risk assessments, security planning, and public safety advisory services.

Learn more about our services or contact our team.