The Key Left Behind

They no longer worked here. And yet, they could still get inside the company.

Cybercrime: Malice in Everyday Life — Part 6

You don't have to be someone special to be targeted.

Everyday life has unseen points of entry. Drawing on publicly available information, we trace how these threats unfold quietly and how their consequences eventually surface in everyday life.

An Amicable Farewell

Frank, who ran a small crowdfunding business, was busy preparing to launch a new product.

The company was still small, with only a few employees. Everyone shared the work, from product planning and promotion to customer support.

Until a few months earlier, they had also had help from an external contractor, Lane.

Lane had been responsible for creating product pages and images. His work was careful, and customers had responded well to it.

There had been no problems when the contract ended.

"Please get in touch if you need anything else."

"Likewise. I hope we can work together again."

And with that, the work came to an amicable end.

Frank wanted to maintain a good relationship with Lane.

He had removed Lane from the company's work chat and organized the materials they had shared.

But he had put off deleting Lane's cloud storage account.

They might need to check old design work again. And if a question came up, it might be quicker to ask Lane.

Besides, Lane was not the kind of person who would do anything wrong.

There was no need to rush.

That was what Frank thought.

A Product Announced First

One morning, with the launch of the new product only a few weeks away, Frank was surprised to see a press release from a competitor.

The competitor had announced a product with a concept very similar to the one his company was preparing.

It was not just the design.

The launch timing, pricing, and intended customer base were all similar.

Of course, similar products can emerge in the same market. It might have been a coincidence.

But something else caught his attention.

Even the details of a campaign his company had not yet announced seemed familiar.

The team checked internally. They had made the planning documents available only to a limited group of people.

Had someone taken them outside the company?

They decided to review the access logs.

That was when they found an unfamiliar record.

There had been an access to the company's cloud storage from Lane's account, even though his contract had ended several months earlier.

And the file that had been downloaded was the plan for the new product.

The access had come through the same home internet connection Lane had used while working with them.

Frank stared at the screen for a while.

The Key That Was Still There

When Frank contacted Lane, he asked about the access logs.

"Had you been using this account to access the cloud storage after your contract ended?"

According to Lane, he had assumed he could still access materials from his previous work because he was still able to sign in to the cloud storage after his contract ended.

That day, too, he had been looking for materials that might be useful as references for earlier projects.

Then he came across the documents for the new product.

Curious, he downloaded them and sent them to an acquaintance to ask for their advice.

He had not thought of it as taking company information without authorization.

"My contract had ended, but the account still worked. I thought that meant I could look at materials related to the work I'd done before."

Even if that was true, it did not make the problem go away.

Someone whose contract had ended had still been able to access internal company documents.

And he had sent them outside the company.

The investigation could not establish how far the document had been forwarded or fully trace the route by which it might have reached the competitor.

But at least some information the company had never intended to release externally had, in fact, left the organization.

Frank thought back over his exchanges with Lane.

When they had worked together, Lane had been someone he could trust.

That was why Frank had not thought there was any need to hurry through special procedures after the contract ended.

But it was Frank's own company that had left Lane in a position where he could still access its information.

What Remains Inside

Japan's Information-technology Promotion Agency (IPA) has repeatedly warned organizations about information leaks caused by people on the inside.

The cause is not always an industrial spy worthy of a movie, or a former employee who holds a grudge against the company.

Some people provide information to outsiders in exchange for money. Others may use information from a former employer at their new workplace.

And sometimes, because an organization has not managed access properly, people remain able to reach information they should no longer be able to access.

In the fifth edition of its Guidelines for Preventing Insider Threats in Organizations, the IPA calls for information assets entrusted to employees or contractors to be returned or completely deleted when employment or a contract ends. It also calls for the removal of user IDs and access privileges to information systems. These IDs and privileges should be removed promptly when the employment or contract ends.

This is more than an administrative procedure.

Who can access what information, and for how long?

Managing those boundaries properly is itself an important part of protecting information.

Cases in which people working for contractors have misused access granted to them for their jobs have also occurred in Japan.

The IPA's Information Security 10 Major Threats 2022 report included a case involving a former employee of a company contracted to maintain and operate a securities firm's systems. The arrest was announced in March 2021.

The misconduct took place while the person was still working on the contract. He abused access privileges granted for his work in both the production and development environments. He copied backup data containing customer information into the development environment, extracted the information, and sent it to a personal email address.

He then used that information to impersonate customers, sell securities, and withdraw cash fraudulently. Fifteen customers were affected, with total losses of approximately 200 million yen.

On January 19, 2022, the Tokyo District Court sentenced the former employee to four years and six months in prison. The judgment became final in February of that year.

This was a case in which access privileges granted for work were abused for criminal purposes. It was not a case of unauthorized access through an account left active after a contract had ended; the privileges had been misused while the person was still working.

Trust Is Not the Same as Leaving Everything to Someone

In the IPA's Information Security 10 Major Threats 2026, "Information leaks and other incidents caused by insider misconduct" was ranked seventh among threats to organizations.

It has appeared on the list for 11 consecutive years, since 2016.

This is hardly a new problem.

And yet, the question of who can use information held inside an organization remains unresolved.

In a small company, employees and external staff often work closely together.

Some relationships have lasted for years. People may have worked together many times and know details about each other's families.

In such relationships, checking access privileges one by one can feel rather cold.

But trusting someone and leaving them with indefinite access are two different things.

When assigning work, give people access to the information they need for that work.

When the work ends, that access should end too.

It is not about suspecting the other person.

It can also protect them from the consequences of an accidental mistake or oversight.

A Place Where No One Should Be

After that, Frank decided to review the company's accounts one by one.

Not just those belonging to current employees, but also former employees, former contractors, and people who had once been brought in for a short-term task.

And not just the cloud storage. Email, online meetings, customer management systems, design services.

There were more places to check than he had expected.

As he looked through the list, he found company names from projects that had ended years ago, and the names of people whose faces he could no longer remember.

Could they still access the systems?

And did the company really know whether they could?

The physical keys to the office had been returned when people left.

But they had even forgotten that digital keys needed to be taken back.

There were people who could still enter rooms that were supposed to be empty.

Would they always discover that only after something had happened?

References

1. Information-technology Promotion Agency (IPA), Japan, Guidelines for Preventing Insider Threats in Organizations, 5th Edition (revised April 2022), section 4-6 (24), "Return of Information Assets upon Termination of Employment or Contract".
   https://www.ipa.go.jp/security/guide/hjuojm00000055l0-att/ps6vr7000000jvcb.pdf

2. Information-technology Promotion Agency (IPA), Japan, Information Security 10 Major Threats 2022, Organizational Threats, No. 5, "Information Leaks Caused by Insider Misconduct" (2022), p. 44.
   https://www.ipa.go.jp/security/10threats/ps6vr7000000ave7-att/000096898.pdf

3. NTT DATA Corporation, Japan, Global Security Trends Quarterly Report, FY2020 Q4 (2021), section 2.2, "Embezzlement of Customer Funds by a Securities Systems Developer".
   https://www.nttdata.com/jp/ja/-/media/nttdatajapan/files/services/security/nttdata_fy2020_4q_securityreport.pdf

4. SCSK Corporation, Japan, "Regarding Misconduct by a Former Employee" (March 24, 2021).
   https://www.scsk.jp/news/2021/pdf/20210324.pdf

5. Matsui Securities Co., Ltd., Japan, "Arrest of a Former Employee of an Outsourced Service Provider" (March 24, 2021).
   https://www2.jpx.co.jp/disc/86280/140120210324483529.pdf

6. Security NEXT, Japan, "SCSK's PrivacyMark Certification Suspended for One Month" (July 8, 2022).
   https://www.security-next.com/137939

7. Information-technology Promotion Agency (IPA), Japan, Information Security 10 Major Threats 2026 (published January 29, 2026; updated May 21, 2026).
   https://www.ipa.go.jp/security/10threats/10threats2026.html

The story in the first part of this article—Frank and Lane, the business and product plans, and the account that remained active after the contract ended—is a fictional reconstruction based on risks described in the insider-threat prevention guidelines and related materials. It does not depict any specific real company or individual. The securities firm case described in the second part is a separate, publicly reported incident.

The references above are Japanese sources. The IPA is a Japanese independent administrative agency; NTT DATA, SCSK, and Matsui Securities are Japanese companies; Security NEXT is a Japanese cybersecurity news publication.