When a former employee leaves with files, customer lists, pricing data, source code, formulas, or other sensitive information, the first few hours often feel chaotic. Access has changed. Devices may be missing. Email rules may have been altered. People inside the company may be asking whether this is “just competition” or something more serious.
In general terms, a calm, evidence-focused response tends to matter more than a fast emotional one. Trade secret and confidential-information cases often turn on what was taken, how it was protected, what systems recorded the activity, and how quickly the company preserved evidence. In this post you’ll learn how businesses often respond, what legal issues may come into play, and where an attorney may help evaluate emergency options.
If you want a broader foundation on this area of law, our overview of what companies look at in trade secret theft disputes can help frame the bigger picture.
<aside> 💡 Scroll to the bottom for every post in this series.
</aside>
Not every departing employee who emails a spreadsheet to a personal account is committing trade secret misappropriation. At the same time, not every “routine” departure is harmless. Under the federal Defend Trade Secrets Act, a trade secret owner may bring a civil action if the trade secret relates to a product or service used in interstate or foreign commerce. The statute also allows courts, in extraordinary circumstances, to issue ex parte seizure orders aimed at preventing further spread of the information. That remedy is unusual, but its existence reflects how quickly digital information can move once it leaves the company’s systems.
State law matters too. Most states use some version of the Uniform Trade Secrets Act framework, which generally protects information that derives economic value from not being generally known and is subject to reasonable secrecy measures. In practical terms, a customer list, pricing model, vendor data set, source code repository, manufacturing process, or internal playbook may or may not qualify depending on the facts, including how secret it really was and what steps the business took to protect it.
That distinction matters because employers sometimes assume every internal file is a trade secret. Courts usually look more carefully than that. A list available from public sources may be treated very differently from a curated database built over years and locked behind access controls.
A common first move is to limit ongoing access. That can include disabling accounts, revoking tokens, changing shared passwords, reviewing cloud permissions, and checking whether any forwarding rules, sync connections, or third-party integrations remain active. Cybersecurity guidance on insider threats regularly emphasizes rapid containment and log preservation because data exfiltration often involves email forwarding, cloud sync tools, removable media, or unusual device activity. CISA’s Insider Threat Mitigation Guide discusses these risks in detail, and CISA’s ransomware response guidance also notes the importance of preserving volatile evidence such as system logs and related records during fast-moving incidents.
That said, containment and preservation can pull in different directions. If an IT team wipes a laptop, resets a mailbox, or overwrites logs too early, the company may lose the very proof it later needs. Under Federal Rule of Civil Procedure 37(e), courts can address the loss of electronically stored information when a party failed to take reasonable steps to preserve data that should have been preserved in anticipated litigation.
Here’s what that often looks like in real life:
If your team is already looking at device logs and download records, our related post on preserving technical evidence in a trade secret dispute would usually be the next issue to examine closely.