The leak that identified its own source

Situation. A company that knew, with certainty, that internal information was reaching a competitor. Commercial terms appearing on the other side of negotiations. Strategy anticipated.

The attack. Somebody inside the building. And the damage compounds unusually, because the second consequence of a leak is what it does to the organisation: everyone is suspected, nothing sensitive can be discussed, and the leadership team stops functioning long before the leak is found.

What most companies do. Confront the people they suspect. This fails in every direction at once — it alerts the actual source, who stops and destroys evidence; it damages the innocent, who remember it; and it produces nothing usable, because a denial is not evidence.

What we did.

• Established scope before suspects. What had left, when, and what it was worth.
• Technical investigation across the channels the information could have travelled, conducted so the findings would survive challenge in an employment tribunal.
• Controlled-disclosure testing. Uniquely varied versions of sensitive information distributed to defined groups. When a variant appeared outside the company, it identified its own source. No accusation, no deception of any individual, no disruption — and unambiguous once it lands.
• Kept it contained. A small group knew the investigation existed. Everyone else carried on, including the source.
• Closed it under counsel, so the outcome was enforceable — and preserved a case against the party receiving the information.

Outcome. The source was identified without ever being alerted. The receiving party settled rather than face proceedings. The wider organisation never spent a day under general suspicion.

The lesson. The instinct in a leak investigation is to look for the person. The discipline is to look for the path, and let it produce the person. Confrontation is what you do at the end, once, with evidence.