Offboarding is only complete once access, devices and mailboxes are dealt with, not with the signature on the termination notice. Three recent cases show why.
Three cases
- USA: A former infrastructure engineer accessed his ex-employer's network remotely in November 2023. Scheduled tasks deleted 13 domain administrator accounts and changed passwords, and 254 servers were locked. He demanded 20 bitcoin, at the time around 750,000 dollars, and has now been sentenced to 32 months in prison. On his company laptop, investigators found a hidden virtual machine.
- Italy: In decision 583 of 6 August 2026, the data protection authority Garante imposed a fine of €225,000 on Michael Page. The email accounts of three departed employees stayed active for over two years, their correspondence was reviewed for a legal dispute, and the information provided was inadequate. In June, Piaggio was hit with €460,000 for retaining emails and access logs for too long.
- Insiders as a commodity: According to the TrendAI report of August 2026, criminals are recruiting employees deliberately, with fixed prices and profit shares. They look for people who can release payments, restore accounts or bypass checks. Golem reported on it on 16 October.
Context: The cases come from the USA and Italy. The GDPR principles (information, purpose limitation, storage limitation) apply across the EU. The TrendAI report comes from a security vendor.
Five points for the last working day (ISO/IEC 27002:2022)
- Block accounts and access, and change passwords on shared administrator accounts (5.18, 8.2)
- Take back and check devices, including for scheduled tasks and virtual machines (5.11)
- Deal with the mailbox: forwarding, short retention, access only with a documented reason, inform employees (5.18, 6.5)
- Monitor access by departed staff in the logs (8.15)
- Assign responsibilities: HR, IT and management countersign the checklist with a date (6.5)
Source: media reports, Garante, TrendAI, Golem
Research as of: October 21, 2026 — Regulation evolves quickly; this post does not replace individual legal or professional advice.
