The ‘Great Resignation’ is causing insider data leaks, theft on unprecedented scale

Some are calling it the ‘turnover tsunami’, but most are referring to it as the Great Resignation, as nearly half of all staff in the US are reconsidering their employment prospects, either hunting for a new job now or planning to, very soon.

As employees switch positions, one of the direct and indirect consequences of such a mass migration of talent will be the loss, misplacement, or even theft of corporate data. Research from the Aberdeen Group of Waltham, Mass. showed that in spite of numerous high-profile incidents of past employees being taken to task for data theft, many soon-to-be-former staff still don’t think too much of removing data from their current workplace.

And a recent survey from the Society for Human Resource Management (SHRM) says that over 40% of US workers are looking for new employment either right now or very soon in the future. That’s twice the number looking to move to a new gig compared to the pre-pandemic period of 2019.

Meanwhile nearly half of US employees (49%) said that their organizations had been experiencing higher or significantly higher talent turnover than usual – the Great Resignation is well and truly on this time.

With over 75% of organizations not possessing adequate visibility over their workplace environments – the majority lacking tools even for proper monitoring – it is unsurprising the number of insider data leaks and theft that the Great Resignation will contribute.

In fact Code42, an insider risk detection and response company, reported that data breaches as a result of internal influences make up about 20% of revenue losses annually, and widespread job losses as a resultant fault line of the Great Resignation is only going to exacerbate the situation.

The second quarter of 2021 saw a 61% increase of data exposure events compared to the same period the previous year, says Code42’s findings derived from its Incydr software solution. This same period accounted for 86% of all exposure events experienced by organizations throughout the first half of the year.

Code42 CEO Joe Payne says that the biggest tell-tale sign that source code or other vital organization data might be lifted, is the fact that the employee is planning to leave. And in this digital age, it has never been easier to slip out data unsuspectingly.

“Data is digital and portable, so I can sit at home, open a browser, and send myself the crown jewels to my personal Google Drive account,” Payne told SD Times. “Nearly all [91%] of security leaders we recently surveyed believe that users are exfiltrating data through personal cloud accounts, yet nearly half [49%] don’t have a tool to differentiate personal and corporate cloud application uploads.”

The three T’s to hold off the great data exfil

Payne emphasized a three-beat risk management program that must comprise elements of transparency, training, and technology. Transparency hints that employers must be properly indoctrinated as to what their responsibilities are towards data privacy, regardless if their leaving the organization or not.

Training meanwhile is vital for staff anyway, especially when it comes to data security and other cyber security threats – without a doubt, people can be the single biggest vulnerability point facing any enterprise. It would benefit companies to have their employees familiarise themselves with company and territorial data protection policies and laws.

And harnessing technology and analytics to understand risk management countermeasures will be helpful when it comes to protecting data points and systems. Payne warned that companies either adopt solutions to manage the ever-evolving threat landscape, or “The Great Resignation” might just turn into the “the Great Data Exfiltration”.

“Companies need to put in place new cloud-based insider risk management technologies that verify when employees are – and are not – working within their organization’s guidelines,” he commented.

“Now is not the time for complacency,” Payne continued. “Companies must take the Great Data Exfiltration head-on before any more data walks out the door.”