Location: Glasgow

Sector: Retail

Reason for Surveillance: Post-Incident Investigation

Background

A regional retail chain headquartered in Glasgow discovered, through a routine internal audit, that a batch of customer loyalty scheme data — including names, addresses, and partial payment card information — appeared to have been accessed and exported from its customer database outside of any scheduled or authorised business process. With no immediate indication of how the export had occurred or who was responsible, and a clear obligation to assess the incident under UK GDPR within a tight regulatory timeframe, the company needed a rapid, thorough post-incident investigation to establish exactly what had happened.

The Brief

We were instructed to work alongside the company’s IT security team and data protection officer to reconstruct the incident: establishing the method of access, the scope of data affected, the likely responsible party or parties, and providing a clear evidential basis for the company’s regulatory notification decision and any subsequent disciplinary or legal action.

The Investigation

We began with a detailed reconstruction of database access logs for the period surrounding the suspected export, working closely with the client’s IT security function to identify the specific account and access method used. The logs showed the export had been carried out using the credentials of a former IT contractor whose access should have been revoked four months earlier, when their contract ended, but had not been — a critical process failure that had left a live, unmonitored access route into the customer database for months after it should have been closed.

We conducted open-source research and, with appropriate authorisation, a review of the former contractor’s known professional activity since leaving the company, identifying that they had, three weeks after the data export, begun a new role at a rival retail business operating in a closely related product category — raising the reasonable possibility that the exported data was intended to support competitive customer targeting at the new employer, though we were careful in our reporting to distinguish this reasonable inference from confirmed fact, given we could not directly establish what, if anything, had been done with the exported data.

We further reviewed the company’s own offboarding process documentation and identified that the specific process failure — a manual, easily missed step in revoking system access upon contract end — had affected at least two other former contractors’ accounts, though our review found no evidence of misuse via those other accounts during the period reviewed.

Given the regulatory time pressure, I worked to a compressed timeline throughout, providing the data protection officer with a preliminary factual summary within forty-eight hours of being instructed, followed by a fuller evidential report within the following week, structured explicitly to map onto the specific questions a UK GDPR notification requires a business to answer: what happened, what data was affected, what the likely consequences are, and what measures have been or will be taken in response. I have found that structuring an investigation report around a client’s actual regulatory obligations, rather than a generic investigative template, saves valuable time when the DPO is working against a genuine deadline.

I also reviewed whether any of the affected customers had reported subsequent suspicious activity, such as unrecognised card transactions, working with the company’s customer service team to establish a simple triage process for any related customer contact during the investigation period, which identified no confirmed instances of financial harm arising from the breach in the weeks following our review, a reassuring, if provisional, finding that the company was able to include in its regulatory notification.

Findings

Our investigation established, with a high degree of confidence, that the data export had been carried out via a former contractor’s access credentials that should have been revoked months earlier, identified the specific process failure responsible, and flagged a plausible, though not conclusively proven, competitive motive linked to the individual’s new employment. Critically, our review confirmed the affected dataset did include partial payment card information, meaning this was assessed by the data protection officer as very likely constituting a notifiable personal data breach under UK GDPR.

Outcome

The company notified the Information Commissioner’s Office and affected customers within the required timeframe, supported by our clear, well-documented reconstruction of events, which the data protection officer specifically credited with allowing a confident, well-evidenced notification rather than a delayed or incomplete one. The company pursued the matter with the former contractor through its solicitors and, separately, used our findings to conduct an immediate, company-wide audit of all other former contractor accounts, revoking six further instances of access that should have been closed previously. A revised, automated offboarding process was implemented to remove the manual step that had caused the original failure.

Lessons for Other Businesses

Post-incident investigations succeed or fail on speed and thoroughness in roughly equal measure, given how tightly regulatory notification deadlines run once a personal data breach is suspected. The most common root cause we encounter in these cases is not a sophisticated external attack but an ordinary, mundane process failure — an access credential that should have been revoked and was not — which underlines why offboarding processes deserve the same rigour as onboarding ones. Businesses should treat any unexplained data access as a trigger for full reconstruction, not just closure of the immediate access route, since the same underlying process gap very often affects more than the single incident that brought it to light.

Investigator’s Reflection

Post-incident work like this is unforgiving of delay in a way that few other categories of investigation are, and I structure my own working practices accordingly — shorter reporting cycles, closer and more frequent contact with the client’s DPO, and a willingness to hand over provisional findings even before every strand is fully closed off, provided that provisional status is made completely clear. What I found most useful to the client in this case was not any single dramatic discovery but the systemic audit that followed the initial finding — closing six further instances of exactly the same vulnerability meant the investigation’s value extended well beyond the single incident that triggered it, which is, in my experience, exactly what a thorough post-incident review should aim to achieve.

Closing Note

Across these twenty case studies, a few themes recur regardless of sector or location: proportionality, corroboration, and process. The strongest investigations are never built on a single piece of evidence or a hunch; they combine multiple, independently verifiable strands — digital logs, physical observation, open-source research, witness accounts — into a picture that can withstand scrutiny, whether that scrutiny comes from a tribunal panel, a regulator, or opposing solicitors in litigation. And time and again, the investigation reveals not just an individual’s wrongdoing but a gap in process that, once closed, protects the business going forward.

If your organisation is facing a situation that echoes any of the above — whether that is unexplained stock loss, a suspected data leak, a whistleblower report, or concerns about an executive’s safety — the earlier an experienced, independent investigator is involved, the more options remain open. Early, proportionate action nearly always produces a better outcome than acting on suspicion alone, or waiting until a situation has escalated beyond a manageable point.

Bond Rees provides corporate investigation and surveillance services to businesses across the UK. All case studies in this document are composite and anonymised accounts based on representative investigative work; names, locations, and identifying details have been altered to protect client confidentiality.