Into the Breach: Uncovering Leaks, Tracing Payments, and Containing Insider Threats

By the time a leak lands on your desk, many of the most consequential decisions in the investigation are already behind you. What you do in the first hours after discovery often determines what can be proven, what can be recovered, and what can be prevented next time. In this edition of The Ethicsverse, Timothy Gallagher, Managing Director, Chief Security Officer & Co-Lead for Physical Security & Threat Mitigation at Nardello & Co.; Kevin Strenski, Senior Analyst, Crypto Investigations at Nardello & Co.; and Christina Gotsis, Partner at Sitaras & Associates PLLC, joined moderator Matt Kelly, CEO & Editor of Radical Compliance, and Nick Gallo, Chief Servant & Co-CEO of Ethico, to unpack how insider-threat investigations actually work.

Tim brings more than 25 years of law enforcement experience, including a career with the FBI; Kevin traces illicit payments through cryptocurrency and traditional channels; and Christina advises companies on investigations and white collar litigation. From containment and evidence preservation to blockchain tracing, prediction markets, and the controls that catch leaks early, here are the key takeaways.

Key Takeaways

A Leak Is Bigger Than a Story in the Press

Tim defined a leak as data your company owns, or has been entrusted to protect, ending up in the hands of someone not authorized to have it. That can be your own business plans or confidential client information that someone seeks to damage you with or monetize through extortion.
Christina has worked the classic version: a mole inside the company selling information for personal gain. But she also sees leaks as weaknesses in internal controls, where data passes, intentionally or not, to someone who should not have it. The fallout extends well beyond money, inviting scrutiny from regulators, investors, and customers.
Kevin stressed that in 2026 the attack surface has expanded dramatically. Information no longer has to be labeled confidential in an employment agreement to be leaked and monetized.
Motives vary. Some insiders want money; others want to tank a deal, harm colleagues, or act on ideology. Kevin noted that AI has added a new category of ideologically motivated leakers, as well as unintentional leaks when employees paste sensitive data into personal or unapproved AI tools.

The First Signal Rarely Looks Like a Leak

Discovery can arrive as an extortion email threatening to post your records on the dark web, or as a quieter realization that competitors seem to know things they should not. Tim recalled an early private-sector case in which a leaked merger effectively killed the deal.
Christina noted that leaks are often found unintentionally, such as a customer reporting that their data surfaced online or a confidential document appearing on Reddit. With the right systems in place, detection should be intentional: unusual downloads or access to files outside someone's role should trigger alerts.
Having those systems is only step one. Making sure they work, and that alerts actually reach someone, is what gets you notified early enough to stop the bleeding.
Nick compared the leak to the top of Heinrich's safety pyramid. Beneath it sit layers of near-misses and leading indicators, such as reports that went nowhere or a coworker acting strangely, that never received action. A strong program surfaces those signals before they become a breach.

The First Hours: Who Is in Charge, What to Preserve, How to Document

Christina's first priority is clarity on who coordinates the response. Confusion causes chaos, and chaos creates legal exposure. She generally recommends counsel lead, since counsel can account for insurance, investor, and regulatory obligations.
Second, have a plan to preserve evidence. Know which systems to turn off, which to preserve, and whether to suspend automatic deletion. What you choose not to preserve can later be used to build a timeline of what the company knew and when, and to draw inferences about intent.
Third, document everything factually. Write that data was accessed by a particular account, not that a particular person accessed it, because someone else may have used the account. Avoid assigning intent too early.
Control communications. Looping in too many people or letting gossip spread over text messages creates off-channel records that can become exhibits in litigation.
Tim agreed that someone has to quarterback the investigation so every workstream feeds into a single point of contact. Investigators want each witness's own story, not secondhand accounts of what they heard from someone else.

Have a Plan, Test the Plan, Try to Break the Plan

Christina observed that preparedness depends heavily on a company's size, sophistication, and appetite for investing in compliance. Some organizations have nothing; many have only generic confidentiality policies.
The companies that fare best in later investigations and litigation have comprehensive policies that define confidential information, leaks, and breaches with real-world examples, plus procedures that ensure flagged issues are followed up and reach management. Policies without working procedures leave a dangerous gap.
Tim's advice to clients: have a plan, test the plan, try to break the plan, then run an after-action review and update it. In tabletop exercises he asks who is in charge, then asks who the backup is if that person is on a plane. The goal is not gotchas but muscle memory.
Matt pointed to a recent sanctions enforcement action in which a company investigated a tip, briefed the board, and then did nothing for months until a reporter called. The company self-disclosed only under pressure and received no credit. Nick urged a high-ownership bias: make sure someone else is clearly holding the baton before you let go of it.

Forensics, Devices, Communications, and Interviews Inform Each Other

Christina described the investigation as iterative. Sometimes the team starts with interviews and no documents; other times with data collection and forensic preservation. Each workstream informs the next, pointing investigators to specific mailboxes, devices, or new people of interest.
She brings in the forensic team immediately, and through counsel. When a company hires forensic investigators directly, there is generally no privilege, so communications about suspicions and suspects may be discoverable later. Engaging through an attorney typically extends attorney-client privilege.
Tim starts with what was leaked and who had access, then prioritizes work that can be done under the radar: communications reviews, well-placed interviews, and remote imaging. That helps collect evidence before it is destroyed, or before people start manufacturing it.
The approach depends on the type of insider. With a suspected malicious insider, there may be value in leaving access in place to trace the pattern, or even seeding known-false information to see where it surfaces. An employee unwittingly feeding data into AI calls for a very different approach.

Following the Money Through Banks and the Blockchain

Kevin typically starts with transaction hashes or crypto wallets. Investigators can also engage the threat actor directly, requesting a small test payment, even a few cents, to identify the wallet on-chain.
From there, funds are traced to on- and off-ramps, usually cryptocurrency exchanges. Exchanges generally collect know-your-customer (KYC) information, which can be obtained through counsel or in coordination with law enforcement to unmask the real person behind a wallet. Crypto is pseudonymous, not anonymous.
Sophisticated actors such as nation states and established transnational crime groups use layers of shell companies with no real person behind them. Less experienced, financially motivated actors are more likely to slip up, and a single payment to an attributed wallet or a cooperative jurisdiction can unravel an entire operation.

Tracing Findings Drive Legal Strategy and the Timing of Law Enforcement

Christina combines blockchain tracing with IT and access logs from digital collections to generate new leads. Exchanges do not always cooperate, and where the funds land, whether crypto or fiat, largely determines the likelihood of recovery.
She described wire fraud cases where money moved to Dubai or Romania. Depending on the jurisdiction, recovery may be worth litigating in Germany or the UK but not worth the cost elsewhere, so the data shapes the strategy and its sequence.
Tim called bringing in law enforcement a double-edged sword. Agencies can freeze funds, identify people, and execute search warrants, but you lose control of the investigation. Against a state actor targeting your intellectual property, call them right away.
In many other cases, Tim recommends a short privileged internal investigation first so the company can brief law enforcement the way agents brief each other: here is what we have and here are the likely targets. Investigators would much rather receive a case with shape than a vague call for help.

Threat Actors Cast a Wide Net

Kevin explained that AI lets bad actors run phishing and recruitment at massive scale. Rather than carefully targeting one person, they cast the widest possible net, especially at high-profile tech and AI companies perceived to hold valuable information.
Small companies are targets for the opposite reason: fewer controls, less security, and IT staff wearing multiple hats.
Nick noted that recruiters often look to LinkedIn and focus on contractors, help desk and support staff, and lower-paid employees who may feel less loyalty. They often start with a small, easy ask; once someone complies, larger requests follow.
That makes authentic ethical culture and training that reaches the front lines essential, with real examples delivered often enough to act as a tripwire before a leak happens.

Prediction Markets Have Lowered the Bar for Monetizing Information

Kevin distinguished insider trading, where someone breaches a fiduciary duty by trading confidential information on a prediction platform, from market manipulation using information that is nonpublic but not technically confidential, such as a personal assistant knowing whether a celebrity will appear at an event.
Most compliance programs do not address that second category. Monitoring prediction markets requires sophisticated scraping tools, so for most companies the key is recognizing when they are in over their heads and bringing in counsel and experts.
Christina noted that people will bet on anything, including government insiders reportedly wagering on military operations. Policies must be tailored to the company's risk environment and spell out prohibited conduct with recognizable examples, backed by periodic risk assessments.
Nick compared leaked information to stolen art: the hard part used to be fencing it. Prediction markets have dropped the barrier to monetization through the floor, potentially multiplying the supply of leaked information.

Access Controls Only Work If Communications Stay on Channel

Tim emphasized logging who accessed what, when, and how, including thumb drive use, remote logins, and documents sent to home computers, with employees told up front that this information will be collected.
The common workaround is off-channel communication on personal phones and devices, where information escapes into the wild and can be hacked or intentionally sent elsewhere.

One Change to Make in the Next 90 Days

Christina: run a data-leak tabletop. Who gets escalated to, which teams respond, and do you already have counsel and a forensic team you can assemble overnight? Identify the questions you cannot answer and get them answered. Even an imperfect plan is far more defensible.
Kevin: revisit your policies. Go beyond what is strictly confidential and define the nonpublic information you do not want employees trading on, monetizing, or publicizing.
Tim: deploy short, mandatory awareness training, around 5 to 7 minutes, using real, anonymized examples so employees know this applies to them. Have everyone certify to it annually.

Closing Thoughts

Insider threats rarely begin with the leak itself. They begin with weak controls, unclear ownership, ignored signals, and policies that never anticipated how information can now be monetized. As this panel made clear, the organizations best positioned to respond are the ones that have already decided who is in charge, structured investigations to preserve privilege, and practiced the plan before they needed it.

When a leak does happen, speed and discipline matter: preserve evidence, document facts without assigning intent, keep communications on channel, and let forensics, interviews, and payment tracing inform each other. Pair that with front-line training and policies that reflect today's risks, from AI tools to prediction markets, and you give your organization a real chance to catch the next leak before it becomes a breach.