Trade Secret Theft by a Former Employee: What Companies Should Do First

When a company suspects trade secret theft by a former employee, the first hours and days after the problem comes to light can affect the entire case. That discovery often comes well after the employee has left — when a competitor’s product looks familiar, a key customer moves, or an internal audit surfaces unusual downloads. The practical goal is not to accuse first. It is to preserve evidence, stop additional access, identify what information is actually at risk, and decide whether the facts support a litigation response under the Defend Trade Secrets Act (DTSA), state trade secret law, contract claims, or emergency injunctive relief.

This guide is for companies, founders, executives, HR teams, legal departments, and general counsel facing a competitor hire, suspicious download activity, missing devices, forwarded emails, or a departing employee who may have taken confidential business information. For searchers looking for trade secret theft former employee guidance, the central point is this: move fast, but do it in a way that preserves credibility in court.

The First Response: Stabilize the Record Before Accusing Anyone

By the time the problem surfaces — sometimes months after the employee has gone — the response starts with a simple threshold question: is the company dealing with routine departure risk, a contract issue, or evidence of misappropriation? Those categories overlap, but they are not the same. A competitor hire alone does not prove trade secret theft. A large download, a copied source-code repository, suspicious USB activity, personal email forwarding, or a cloud export near resignation may justify immediate escalation. When concrete red flags are present, litigation counsel should direct the preservation and forensic scope from the first day.

A disciplined early response preserves the record before interviewing the employee. Lock down access before debating motive. Identify the specific business information at risk before drafting a demand letter. If the dispute reaches court, the judge will care not only about what the former employee did, but also about how carefully the company responded.

Phase	Company Action	Why It Matters
First, on discovery	Disable active access, preserve email and account logs, identify devices, stop routine deletion, and escalate to litigation counsel if red flags or emergency-relief risk exist.	Prevents additional access and reduces spoliation risk before the facts are fully known.
Next	Collect key employment documents, map suspected trade secrets, and conduct a scoped forensic triage.	Separates actual confidential information from general skill, memory, or ordinary business knowledge.
As facts develop	Assess DTSA, state-law, contract, and injunctive-relief options with litigation counsel.	Creates a defensible path for a demand, preservation notice, TRO request, or decision not to sue.

Preserve Evidence Without Overreaching

Evidence preservation should begin immediately, but it should not become uncontrolled self-help. The company should preserve its own systems, company-issued devices, email accounts, chat records, cloud storage, badge logs, VPN logs, CRM exports, code repository activity, print logs, and mobile-device-management records. The company should also preserve records of the employee’s resignation, recruiting timeline, role change, and access permissions.

What the company should not do is just as important. Do not access personal email, personal cloud storage, or personal devices without a lawful basis, consent, or court process. Do not pressure IT to search beyond the company systems it is authorized to administer. Do not contact the new employer with accusations that exceed the evidence. Do not tell customers or staff that the former employee stole trade secrets unless counsel has reviewed the factual basis and business risk.

Early forensic work should be scoped and documented. If a company-issued laptop is available, preserve a forensic image before changing files. If email forwarding rules exist, preserve the account state before deleting them. If logs roll off after a short period, capture them quickly and record who collected them, when, from which system, and by what method. Chain of custody is not a courtroom formality. It is how a company proves later that the evidence was not altered to fit the case.

Issue a Litigation Hold and Suspend Auto-Deletion

If litigation is reasonably anticipated, the company should issue a litigation hold. The hold should reach beyond the employee’s mailbox. It should identify business custodians who may have relevant information, including HR, the direct manager, IT/security personnel, finance or sales leaders, product owners, source-code administrators, customer account teams, and anyone who received or investigated the suspected data movement.

The hold should also suspend deletion rules that could destroy electronically stored information (ESI). That may include email retention policies, Slack or Teams deletion settings, document-management expiration rules, cloud-storage lifecycle policies, endpoint logs, MDM records, and ticketing-system logs. Under Fed. R. Civ. P. 37(e), loss of ESI that should have been preserved can produce remedial measures or sanctions if the party failed to take reasonable steps to preserve it and the information cannot be restored or replaced.

A hold does not need to be theatrical. It needs to be clear, tracked, and enforceable. The company should record who received it, what systems were covered, what deletion settings were suspended, and whether any data was already lost before the hold took effect. That record becomes important if the former employee or new employer later argues that the company waited too long or selectively preserved only favorable evidence.

Conduct a Device/Account/Access Review

The device/account/access review should answer four practical questions: what did the employee have access to, what did the employee actually access, what moved outside ordinary work patterns, and what access remains open. The review should include both obvious and less obvious systems: laptop, phone if company-issued, email, file shares, Google Workspace or Microsoft 365, CRM, source-code repositories, design libraries, finance systems, ticketing tools, VPN, SSO, cloud dashboards, personal forwarding rules, external sharing links, and collaboration platforms.

Access removal should be immediate and documented. Disable credentials, rotate shared passwords, revoke API keys, terminate active sessions, remove external sharing links, and review administrator privileges. If the former employee had broad access, consider whether the company should rotate customer-facing credentials, repository deploy keys, or infrastructure secrets. Those steps are not simply IT hygiene. They may become evidence that the company used reasonable measures to protect the information it later calls a trade secret.

The review should distinguish access from misuse. Access to sensitive data may support concern, but trade secret litigation usually needs more than the fact that an employee once had permission to see information. Stronger facts include unusual downloads, copying shortly before departure, deletion of local artifacts, forwarding to personal accounts, repository cloning outside normal workflow, use of external drives, wiping activity, communications with a competitor about the same subject matter, or a new role that maps directly onto the prior confidential project.

Evaluate Existing NDAs, Employment Agreements, and Confidentiality Agreements

Signed agreements are part of the litigation record. The company should collect the employee’s offer letter, employment agreement, non-disclosure agreement (NDA), confidentiality agreement, invention-assignment agreement, employee handbook acknowledgments, exit certifications, data-security policies, and any role-specific access policies. Counsel should evaluate what obligations existed, when they were signed, whether they survived termination, what information they covered, and whether any forum-selection, arbitration, choice-of-law, fee-shifting, or notice language affects litigation strategy.

This is not a substitute for proving a trade secret. A broad confidentiality agreement may support a contract claim or reasonable-measures argument, but courts generally expect the plaintiff to identify the asserted trade secrets with enough specificity to separate protected information from general skill, experience, public information, or ordinary competition. The agreement record is strongest when paired with evidence that the company actually limited access, marked or segregated sensitive information, trained employees, and enforced confidentiality obligations before the dispute arose.

For non-compete provisions, the analysis should stay tied to trade secret litigation and be jurisdictionally cautious. A company should not convert a trade secret investigation into a generic effort to stop a former employee from working for a competitor. The DTSA’s injunction language limits employment restraints: an order may not prevent a person from entering an employment relationship, and any employment conditions must be based on evidence of threatened misappropriation rather than merely on information the person knows. State law may impose additional limits.

Assess DTSA and State-Law Claims

The DTSA provides a federal civil action for trade secret misappropriation when the trade secret is related to a product or service used in, or intended for use in, interstate or foreign commerce. The statutory definitions in 18 U.S.C. § 1839 focus on information that derives independent economic value from not being generally known or readily ascertainable, and that the owner took reasonable measures to keep secret. Misappropriation can involve improper acquisition, disclosure, or use.

State law still matters. New Jersey has the New Jersey Trade Secrets Act. Washington, DC has a trade secret statute, including definitions at D.C. Code § 36-401. New York continues to rely heavily on common-law trade secret doctrine, including factors discussed by the New York Court of Appeals in Ashland Management Inc. v. Janien, 82 N.Y.2d 395 (1993).

For a plaintiff, the claim assessment should be concrete. What precise information is the trade secret? Who had access? How was it protected? What evidence suggests improper acquisition, use, or disclosure? What harm will occur if the former employee or competitor uses it? For a defendant, the same questions often create the defense: the information was public, stale, generally known, not owned by the plaintiff, not protected by reasonable measures, independently developed, or not actually used.

Specificity is critical. In Oakwood Laboratories LLC v. Thanoo, 999 F.3d 892 (3d Cir. 2021), the Third Circuit addressed trade secret identification and allegations that the defendants’ access to information could assist or accelerate competing development. The case is a reminder that trade secret complaints should identify the asserted information and the alleged misuse with enough detail to survive early challenge without disclosing the secret itself in public filings.

When a TRO or Preliminary Injunction Makes Sense

Emergency relief should be considered when delay will allow use, disclosure, customer disruption, product launch harm, or loss of secrecy that money damages may not adequately repair. A TRO or preliminary injunction is not a press release with a court caption. It is a request for a judge to restrict conduct before final judgment, often on an expedited record. That means the evidence, proposed order, and requested restraint need to be precise.

Under Fed. R. Civ. P. 65, temporary restraining orders and preliminary injunctions carry procedural requirements, and Rule 65(c) generally requires security for costs and damages sustained by a party later found to have been wrongfully enjoined. The Supreme Court’s standard in Winter v. Natural Resources Defense Council, Inc., 555 U.S. 7 (2008), requires a showing of likely success on the merits, likely irreparable harm, the balance of equities, and the public interest.

Trade secret cases require careful irreparable-harm analysis. A company seeking an injunction should not rely on the idea that every alleged trade secret dispute automatically creates irreparable harm. The papers should explain why the threatened use or disclosure creates harm that cannot be adequately fixed later, such as loss of secrecy, unrecoverable competitive harm, customer disruption tied to protected information, or a product launch that depends on the disputed material.

Ex parte relief should be treated as exceptional. The DTSA includes an ex parte seizure mechanism in narrow circumstances, but it is not the ordinary first move in most former-employee disputes. More commonly, litigation counsel will consider a preservation demand, negotiated return or sequestration protocol, complaint under seal, expedited discovery, TRO, preliminary injunction, or stipulated order that requires preservation, non-use, device inspection, and deletion only after a counsel-approved or court-ordered preservation and verification process.

Mistakes to Avoid

The most damaging mistakes usually come from acting too broadly or too casually. A company can weaken a strong case by destroying logs, changing a laptop before imaging it, sending an inflated demand letter, asserting every piece of confidential information as a trade secret, contacting the new employer with unsupported accusations, or seeking an injunction that looks like a non-compete in trade secret clothing.

Companies should also avoid treating IT, HR, and legal as separate tracks. If HR interviews the former employee before IT preserves the device, the employee may change or delete evidence. If IT disables an account without preserving access logs, key data may be lost. If legal sends a litigation hold that does not reach the right custodians, later discovery can expose gaps. The early response should be coordinated, documented, and proportionate.

When to Involve Litigation Counsel

Litigation counsel should be involved early when there is evidence of unusual downloading, personal email forwarding, repository cloning, device wiping, customer solicitation using confidential information, competitor onboarding tied to the same project, refusal to return company materials, or a credible need for emergency relief. Counsel can also help structure the forensic review so the company preserves privilege where available and avoids expanding collection beyond a defensible scope.

Early counsel involvement is especially important before contacting the former employee’s new employer. A carefully drafted preservation and non-use letter can protect the record. An overbroad accusation can create defamation, tortious-interference, business-relations, or credibility problems. The line between necessary notice and unnecessary escalation depends on the evidence, the contracts, the information at issue, and the likely litigation forum.

For companies that may be defendants, counsel should also be involved quickly. A new employer that receives a threat letter should preserve recruiting, onboarding, role-definition, device, and communications records. It should screen the employee from disputed information where appropriate, instruct the employee not to use or disclose the former employer’s materials, and avoid accepting any documents, source code, customer files, pricing files, formulas, product roadmaps, or technical data that belong to the prior employer.

Plaintiff and Defense Considerations

Trade secret disputes are not one-sided. The plaintiff’s goal is to protect secrecy and stop misuse without overclaiming. The defense goal is to preserve evidence, challenge unsupported claims, and prevent a trade secret case from becoming an unlawful restraint on ordinary employment or competition. Both sides should think about how the case will look at the first injunction hearing, not only how the first letter reads.

Issue	Plaintiff Consideration	Defense Consideration
Trade secret identity	Define the asserted secrets with enough specificity to support relief without public disclosure.	Challenge vague categories, public information, stale data, and general employee knowledge.
Reasonable measures	Show access controls, policies, agreements, training, labeling, and enforcement history.	Test whether the plaintiff actually protected the information before the dispute.
Misappropriation evidence	Tie downloads, transfers, access, or communications to actual or threatened use.	Preserve independent-development evidence and explain ordinary work activity.
Injunction scope	Request targeted return, preservation, non-use, disclosure limits, or inspection relief.	Oppose restraints that function as a non-compete without evidence of threatened misuse.

How Keyhani LLC Approaches These Disputes

Keyhani LLC represents plaintiffs and defendants in intellectual property litigation, including trade secret litigation, NDA and confidentiality disputes, and federal-court IP disputes. The firm handles evidence-preservation strategy, enforcement, defense, emergency relief, and overall case strategy in former-employee and competitor matters.

In a former-employee trade secret dispute, the first questions are litigation questions: what evidence exists, what must be preserved, what claims or defenses are viable, whether a TRO is justified and the necessity of quick action, how to avoid spoliation, and how to frame relief without overreaching. Keyhani LLC’s work is focused on those dispute decisions for companies and accused parties facing active or threatened IP litigation.

Keyhani LLC litigates intellectual property disputes in federal courts nationwide and serves U.S. and international clients, with concentrated federal-court experience across trade secret and related business disputes and a regional focus that includes New Jersey, the New York Metro area, and Washington, DC. Founder Darius Keyhani has 20+ years of IP litigation experience and has served as lead counsel in 80+ federal cases. Frances Stephenson is admitted in New York and works on IP litigation matters, including trade secret and NDA breach disputes.

FAQs About Former-Employee Trade Secret Theft

The practical takeaway is simple: preserve first, lock down access, identify the specific trade secret, avoid unsupported accusations, and tailor any emergency relief to evidence of actual or threatened misuse. That sequence protects the company’s position whether the response is a demand letter, negotiated return protocol, TRO request, or defense against an overbroad claim.