An Employee Left With Confidential Files: What to Do First

The most damaging thing a company can do in the week after discovering that an employee took confidential information is to wipe and reissue the laptop. The second most damaging is to call the employee’s new employer in anger before anyone has read the agreements. Trade secret cases are won on evidence gathered in the first days and lost on evidence destroyed in the same window. Below is the sequence our trade secret protection team follows when a client reports a suspected theft, in the order that preserves the most options.

Preserve everything, immediately

Issue a litigation hold the day the suspicion arises. That means no deletion, no reimaging, and no “cleanup” of the departed employee’s accounts, devices, or email. Take the laptop, phone, and any external drives out of circulation and have them forensically imaged by a qualified vendor, who will document the chain of custody. The forensic image is what shows USB devices connected, files copied to personal cloud accounts, emails sent to a personal address, and the timestamps that tie it together. IT staff opening the files themselves can alter metadata and will be cross-examined about it.

Pull the access logs from every system the employee could reach: file servers, code repositories, CRM, email, cloud storage. Export them now, because retention windows on some platforms are short. Capture the employee’s recent activity for the last several weeks before departure, which is when most downloads happen.

Do not access the employee’s personal email, personal cloud accounts, or personal devices, even if the credentials are saved on the company laptop. Doing so can expose the company to liability under federal and state computer access and privacy laws and can poison the evidence.

Gather the agreements and the policies

The claims available depend on what the employee signed. Collect the offer letter, the confidential information and invention assignment agreement, any non-solicitation or non-competition agreement, the handbook acknowledgment, the confidentiality policy, and the exit paperwork if any was completed. Note the governing law and any arbitration or forum clause, which determine where the dispute will be heard.

If the employee never signed a confidentiality agreement, the trade secret claim still exists under statute, but a breach of contract claim does not, and the question of reasonable measures becomes harder. The gaps a program should close before this moment are listed in our post on reasonable measures to protect trade secrets.

Identify what confidential information was taken

Not everything a departing employee copies is a trade secret. A court will ask the company to identify the specific information at issue and show that it has value because it is secret and was protected. Separate the files the forensic review identifies into categories: genuine trade secrets (source code, formulas, customer pricing, product roadmaps), confidential but not secret (internal memos that would not help a competitor), and the employee’s own general knowledge, which cannot be claimed. Build the case around the first category. Overclaiming invites a defense that the company treats everything as secret and therefore nothing in particular.

Assess the threat and the goal

What does the company actually want? Usually some combination of the following: return and destruction of the files, confirmation that nothing was used or shared, assurance that the new employer does not have them, and, where the damage is already done, compensation. The answer determines the remedy. If the information has not yet been used and the new employer may not know it exists, a fast demand that secures return and a sworn certification may be the best outcome. If the information is already in a competitor’s product, an injunction and damages are the objective and the case will be litigated.

Send the demand, carefully

A demand letter goes to the former employee and, in most cases, to the new employer, placing both on notice of the company’s rights, the employee’s obligations, and the evidence that files were taken. The letter demands preservation, return, a certification of destruction, and written confirmation of non-use, with a short deadline.

Tone and content matter. Statements to the new employer that go beyond the evidence can draw a defamation or tortious interference counterclaim. The letter should state what the logs show, not what the company suspects. It should also avoid demanding that the employee be fired; the lawful request is that the new employer ensure the information is not used.

The litigation options

If the demand does not resolve the matter, the Defend Trade Secrets Act provides a federal claim, and state law (the Uniform Trade Secrets Act in Virginia and the District of Columbia, common law in New York) provides a parallel one. The remedies include a temporary restraining order and preliminary injunction to stop use and disclosure, damages for actual loss and unjust enrichment or a reasonable royalty, enhanced damages and attorney’s fees for willful and malicious misappropriation, and, in extraordinary circumstances where the evidence would otherwise be destroyed, an ex parte seizure order under the DTSA.

Two limits deserve mention. A DTSA injunction cannot bar a person from taking a job, and any conditions on their employment must rest on evidence of actual or threatened misappropriation rather than on the fact that the person knows the information. Whether a court will infer threatened misappropriation from the nature of the new role (the “inevitable disclosure” theory) varies by state and should not be assumed. And claims under the DTSA must be brought within three years of when the misappropriation was discovered or reasonably should have been. The stages of such a case are described in our post on what happens in an IP infringement lawsuit.

Criminal referral and insurance

Serious thefts, especially those involving foreign competitors or large-scale exfiltration, may warrant a referral to federal or state law enforcement under the Economic Espionage Act or state computer crime statutes. A referral is a separate decision with its own tradeoffs, since the company loses control of the timeline once prosecutors are involved. Check insurance policies as well; some cyber and crime policies respond to employee data theft, and notice deadlines are short. Our IP litigation and dispute resolution and commercial litigation teams handle the civil side and coordinate referrals where appropriate.

If you suspect a departing employee took confidential files, a consultation with Capitol Law Partners today can secure the evidence and set the response before options close. Schedule a consultation.

This article is for informational purposes only and does not constitute legal advice. No attorney-client relationship is formed by this communication.

Attorney Cagatay Ersoy. Practical strategy for founders, investors, and growing companies.

Need help with this topic? See our trade secret misappropriation response page or schedule a consultation.