1 article with this tag
A dispatched systems engineer at an outsourced group company used legitimately granted database access to copy customer data in bulk, transfer it to a personal smartphone, and sell it to data brokers. The monitoring software blocked writes to USB storage but did not block transfer to a smartphone (MTP). Up to ~35 million records leaked. Defend by minimizing privilege (least privilege / need-to-know), closing every exfiltration path with DLP, detecting bulk access, and extending oversight all the way to contractors and sub-contractors.