Employee data theft is the unauthorized copying, downloading, or transfer of company information by a worker, and it can trigger federal civil lawsuits, criminal prosecution, and prison time under the Computer Fraud and Abuse Act, the Defend Trade Secrets Act, and the Economic Espionage Act. State trade secret statutes add another layer. The size of the exposure depends on what was taken, how it was taken, and whether the employer did the things courts expect before the theft occurred.
What the Conduct Looks Like
The category covers any removal of company information the worker had no authorization to take. Common targets are proprietary source code, client lists with contact details and pricing, internal financial records, and protected health information. The data does not need to be marked “confidential” to create legal exposure. If it has value to the company and the employee had no right to remove it, the conduct is in scope.
The methods are mundane. Employees forward sensitive files to personal email, sync work folders to personal cloud storage, or copy databases onto USB drives. Activity spikes around resignation dates, with IT departments regularly seeing departing workers download unusual volumes of data between notice and last day. A slower pattern is forwarding internal emails to a personal address over weeks or months, building a quiet archive that walks out the door.
When the Taken Data Qualifies as a Trade Secret
Not everything an employee walks off with is a trade secret. Federal law applies the label only when two conditions are met: the information must derive economic value from being kept secret, and the owner must have taken reasonable steps to maintain that secrecy.1Office of the Law Revision Counsel. 18 USC 1839 Definitions The subject matter can be financial, business, scientific, technical, or engineering information in any form.
The “reasonable measures” element is where employers lose cases. Courts generally want to see at least two protective layers working together. A nondisclosure agreement by itself is not enough. Pair it with access controls, password-protected systems, and written policies that identify what the company treats as confidential, and the foundation is there. Store a client list on an open shared drive with no restrictions, and that list will struggle to qualify as a trade secret no matter what it is worth commercially.
This threshold matters because if the stolen data does not meet the definition, the strongest federal protections drop away. The employer may still have breach of contract or unauthorized access claims, but the trade secret statutes with their enhanced damages and criminal penalties are off the table.
The Computer Fraud and Abuse Act
The CFAA makes it a federal crime to access a computer without authorization or to exceed the scope of authorized access and obtain information from it.2Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers In employee cases, the fight is usually over what “exceeds authorized access” means when the worker already had valid login credentials.
The Supreme Court narrowed that question in 2021. In Van Buren v. United States, the Court held the phrase reaches someone who accesses files, folders, or databases they were never entitled to reach. It does not cover an employee who accesses information they were allowed to see and then misuses it. A sales representative who downloads their own client list to take to a competitor may fall outside the CFAA if they had legitimate access to that list, even though the purpose was improper. The distinction decides a large share of departing-employee cases, because many of these workers only touch data they already had permission to view.
Criminal penalties scale with the offense. A first-time violation for unauthorized access to obtain information can bring up to one year in prison. That jumps to five years if the access was for commercial advantage, in furtherance of another crime, or if the stolen information was worth more than $5,000.3Office of the Law Revision Counsel. 18 US Code 1030 – Fraud and Related Activity in Connection With Computers Repeat offenders face up to ten years. The statute also creates a private right of action for employers to sue for compensatory damages and injunctive relief, with a two-year window from the act or its discovery.
Civil Remedies Under the Defend Trade Secrets Act
The DTSA, passed in 2016, gives trade secret owners a federal civil cause of action when their secrets are misappropriated and relate to a product or service in interstate commerce.4Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings Before it existed, employers depended entirely on state law, which varied in protections and procedure. The federal statute offers a uniform option.
Courts can award compensatory damages covering actual losses and any profits the thief earned from the stolen information. If the misappropriation was willful and malicious, the court can add exemplary damages up to twice the compensatory amount. Attorney fees are available to the prevailing party when a claim is brought in bad faith or the conduct was willful and malicious.5Office of the Law Revision Counsel. 18 US Code 1836 – Civil Proceedings That fee provision cuts both directions: a frivolous defense can leave the employee paying the employer’s lawyers, and a meritless claim can leave the employer paying the employee’s.
Injunctive relief is often the most urgent tool. A court can order a former employee to stop using or sharing the stolen data, return all copies, and delete anything stored on personal devices. Those orders can be temporary while litigation proceeds or permanent after judgment.
In extraordinary cases, the DTSA permits an ex parte seizure order. If the employer can show that a standard injunction would be ignored and that irreparable harm is imminent, a court can order the physical seizure of devices or materials holding the trade secret without advance notice to the other side.4Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings Courts grant these sparingly, requiring specific facts that the person would destroy, hide, or move the materials if tipped off. The remedy exists because digital files can be erased in seconds.
Nearly every state has adopted some version of the Uniform Trade Secrets Act, and employers often file state and federal claims in parallel. State law occasionally offers a longer limitations period or a remedy the DTSA lacks.
Criminal Penalties for Trade Secret Theft
The criminal side runs through the Economic Espionage Act, which draws a sharp line between domestic commercial theft and foreign-sponsored espionage.
Stealing trade secrets for domestic commercial benefit is a federal felony carrying up to ten years in prison for individuals. Organizations that participate in or benefit from the theft face fines of up to $5 million or three times the value of the stolen secret, whichever is greater.6Office of the Law Revision Counsel. 18 USC 1832 – Theft of Trade Secrets The three-times multiplier can produce enormous fines where the information is core technology or a large client database.
When the theft is intended to benefit a foreign government or foreign agent, the penalties escalate. Individuals face up to 15 years in prison and fines up to $5 million. Organizations can be fined up to $10 million or three times the value of the stolen secret.7Office of the Law Revision Counsel. 18 US Code 1831 – Economic Espionage The Department of Justice prosecutes these cases, which typically involve employees passing proprietary technology to foreign competitors or state-backed enterprises.
The Whistleblower Carve-Out
Federal law shields employees who disclose trade secrets to report suspected illegal activity. No criminal or civil liability attaches under any federal or state trade secret law for disclosing a trade secret in confidence to a government official or an attorney solely to report or investigate a suspected violation of law. The same protection covers disclosures made in sealed court filings.8Office of the Law Revision Counsel. 18 USC 1833 – Exceptions to Prohibitions
That immunity has a bite aimed at employers. Any employment contract or agreement governing trade secrets or confidential information must include a notice of this whistleblower immunity, either as a direct statement or a cross-reference to a company policy. If the employer leaves the notice out, it forfeits the ability to recover exemplary damages or attorney fees in a DTSA suit against that employee.8Office of the Law Revision Counsel. 18 USC 1833 – Exceptions to Prohibitions It is a detail employers routinely miss and that costs real money when litigation starts.
Proving the Case and the Spoliation Trap
Winning a theft case takes digital evidence that builds a clear timeline of what was taken, when, and how. Server audit logs record every file access, modification, and transfer tied to a specific user account, and often reveal a download spike in the days around a resignation. Outgoing email logs showing sensitive attachments sent to personal addresses add another layer. File metadata establishes ownership through creation dates, modification history, and the accounts that touched the file. Forensic analysis of the work computer can identify when external USB devices were connected, whether unauthorized cloud-syncing software was installed, and whether files or browser histories were deleted.
Employees who destroy evidence after litigation is reasonably anticipated face spoliation sanctions: monetary penalties, adverse inference instructions telling the jury to presume the destroyed material was unfavorable, or in extreme cases default judgment. The same rule applies to the company. One federal court imposed a mandatory adverse inference against a business that shortened its messaging platform’s retention period from indefinite to seven days after being put on notice of litigation. Once a dispute is foreseeable, both sides must preserve relevant data.
Breach Notification When Third-Party Data Is Involved
If the stolen data includes personal information belonging to customers, patients, or others, notification obligations stack on top of the civil and criminal exposure.
Publicly traded companies must report material cybersecurity incidents on SEC Form 8-K within four business days of determining the incident is material.9U.S. Securities and Exchange Commission. Form 8-K The clock starts at the materiality determination, not the incident itself, though the company cannot use that ambiguity to delay indefinitely.
Where the stolen data includes protected health information, the HIPAA Breach Notification Rule applies. Covered entities and their business associates must notify affected individuals within 60 days of discovering the breach.10U.S. Department of Health and Human Services. Breach Notification Rule Breaches affecting 500 or more people also require notice to the Department of Health and Human Services and to prominent media outlets. Every state has its own data breach notification law with varying triggers and timelines, so the specific obligations turn on where affected individuals live and what type of data was taken.
What Employers Should Have in Place Before a Theft
The strongest legal position comes from steps taken before anything is stolen. Courts expect to see that the employer treated the information as protected in the first place; companies that handled sensitive data casually and then demand aggressive remedies after the fact meet skepticism.
The minimum framework combines at least two of the following: nondisclosure agreements signed before the employee gets access to sensitive information, written policies that specifically identify the categories of information the company treats as confidential, and technical access controls limiting who can reach what.1Office of the Law Revision Counsel. 18 USC 1839 Definitions A generic line stating “all company information is confidential” carries little weight. Courts want specificity about what is protected and why.
Employment agreements should include the whistleblower immunity notice the DTSA requires, a clear statement that company data remains company property, and an obligation to return or destroy all materials on separation. None of this guarantees nothing will be taken, but it removes the most common defense: that no one told the employee the information was off-limits.