The Sabotage Came From Inside the Company

A multinational tobacco company had been placed in receivership, and the court-appointed chief executive had a problem he could not prove. He believed senior people inside the company were working against it. Suspicion is not evidence, and the people under suspicion held some of the most trusted positions in the organization.

Where the numbers did not add up

We started with the money. Reviewing recent financial transactions tied to the company’s vice presidents, we found activity tied to one executive that did not originate where it should have. The transactions and the emails behind them traced back to a different IP address than the person they were supposed to belong to. That gap between the name on the record and the source of the activity is usually where the truth is hiding.

One address, two crimes

The picture sharpened when the company’s age-verification application went dark. That software was not optional; it was required for federal regulatory compliance, and disabling it put the whole operation at risk. We traced the sabotage back to the same originating IP address we had already flagged in the financial review. Both the money movement and the shutdown led to one person: the head of global IT operations, someone with the access and the seniority to do real damage quietly.

Trust is not the same as proof

The executive who did the most harm was the one the company trusted with its systems. That is the pattern in insider cases. The answer is rarely the outsider everyone fears; it is the person already inside the walls, and the only way to name them is to follow the evidence rather than the org chart. Unmasking that person is the work we do every day across our cyber crime investigations.

If you suspect someone inside your organization and you need proof rather than a hunch, talk to our team.

Your Examiner