Attack #6: Insider Threat

When trusted access becomes the risk

Threat snapshot – Insider Threat

How the attack works

Insider threats do not begin with intrusion.
They begin with access that already exists.

Employees, contractors, or partners often have legitimate access to systems, data, and internal workflows. When that access is misused, intentionally or unintentionally, the impact can be significant.

Sometimes the motivation is financial gain or retaliation.
Other times it is pressure, negligence, or simple human error.

Unlike external attacks, insider threats operate within trusted boundaries. That makes them harder to detect and often slower to recognize.

Real-World Cases

An insider threat occurs when a current or former employee, contractor, or other trusted user misuses legitimate access. The activity may be intentional, negligent, or enabled by excessive permissions that were not removed in time.

Tesla (2023)

Sector: Automotive Manufacturing and Technology

How did the incident begin?
In May 2023, German publication Handelsblatt informed Tesla that it had obtained confidential company information. Tesla’s investigation found that two former employees had misappropriated the data in violation of company policies and shared it with the media outlet.

What was compromised?

• records relating to current and former employees;
• names and contact details;
• sensitive personal information, including Social Security numbers;
• data relating to 75,735 individuals.

How did the attack develop?
Tesla filed lawsuits against the two former employees and obtained court orders preventing further access, use, or distribution of the data. Electronic devices believed to contain the information were seized. Tesla stated that it had found no evidence that the personal information had been misused in a way that caused harm.

What could have reduced the impact?

• role-based access restrictions;
• monitoring for bulk downloads and data transfers;
• timely removal of access during offboarding;
• DLP (Data Loss Prevention) controls for sensitive information.

Cash App Investing (2021–2022)

Sector: Financial Technology and Investment Services

How did the incident begin?
A former Cash App Investing employee downloaded internal customer reports on 10 December 2021. The individual had previously been authorized to access the reports as part of their job but accessed them without permission after their employment had ended.

What was compromised?

• full names;
• brokerage account numbers;
• for some customers, portfolio value and holdings;
• stock-trading activity for one trading day.

The company contacted approximately 8.2 million current and former customers. The reports did not contain passwords, Social Security numbers, bank-account details, or payment-card information.

How did the attack develop?
After discovering the incident, Block launched an investigation with external forensic support, notified regulators and law enforcement, and reviewed its administrative and technical safeguards. The company did not publicly explain how the former employee retained or obtained access after leaving.

What could have reduced the impact?

• automatic access termination during offboarding;
• regular reviews of permissions and inactive accounts;
• detection of unusual report downloads;
• least-privilege access controls.

What do these incidents show?

At Tesla, former employees intentionally removed confidential information from the organization. At Cash App Investing, a former employee accessed customer reports after their employment had ended.

Both incidents show that insider risk is not limited to current employees. Access controls must cover the entire identity lifecycle — from granting permissions to removing them immediately when a role changes or employment ends.

Who they most often involve

Insider threats are not limited to a single role.

Roles

• employees with access to sensitive systems
• IT administrators and system operators
• contractors and third-party partners
• developers and DevOps teams

Sectors

• technology and software companies
• financial institutions
• healthcare organizations
• research and development environments
• public sector

Organization types

• organizations handling sensitive data or IP
• companies with high employee turnover
• distributed and remote teams
• environments with weak access governance

The more access individuals have, the higher the potential risk.

What the attack relies on

Insider incidents often emerge where trust is not continuously verified.

Human factors

• negligence or human error
• frustration or dissatisfaction
• financial motivation
• lack of awareness

Technical gaps

• excessive user privileges
• weak monitoring of internal activity
• lack of access control enforcement
• insufficient logging and visibility

Process weaknesses

• poor onboarding and offboarding
• unclear data handling policies
• lack of separation of duties
• absence of internal audit practices

Insider threats exploit access that organizations themselves provide.

How it is detected

Detection depends on understanding what “normal” looks like.

What users may notice

• missing or altered files
• unusual access to shared data
• unexpected system changes

What IT teams observe

• large data downloads
• unusual database queries
• abnormal login patterns
• unauthorized access attempts

What SOC teams detect

• behavioral anomalies
• suspicious data transfers
• misuse of privileged accounts
• policy violations

Behavioral signals are often the earliest indicator.

How impact is contained

Response must balance speed, accuracy, and internal sensitivity.

Immediate priorities include:

• restricting or suspending suspicious accounts
• preserving logs and forensic evidence
• limiting access to critical systems
• notifying security and management teams
• conducting internal investigation

What does not help:

• ignoring early warning signs
• delaying action due to uncertainty
• overreacting without evidence

Containment requires control without disrupting operations unnecessarily.

What realistically helps

Managing insider risk requires structure and consistency.

People

• security awareness programs
• clear accountability
• training on data handling

Processes

• access lifecycle management
• separation of duties
• regular access reviews
• structured offboarding

Technology

• privileged access management (PAM)
• user behavior analytics (UBA)
• data loss prevention (DLP)
• centralized logging and monitoring

Security must extend inside the organization, not only around it.

Common myths

“Insiders are rare compared to external attackers”
“Employees would not harm the organization”
“Monitoring internal activity reduces trust”

In reality, insider incidents are often the result of accumulated access and process gaps.

Attack #1: Phishing & Social Engineering

Attack #2: Credential Abuse & Account Takeover

Attack #3: Business Email Compromise (BEC)

Attack #4: Ransomware

Attack #5: Supply Chain Attack

Next: Attack #7 – Malware & Infostealers