Welcome back to Part 2 of our Cyber Horror Stories series with incident response expert Matt O’Kane.
In this episode, we dig into a real-world story from the pandemic era, when a marketing manager, a BYOD MacBook, and a fractured workplace relationship led to a messy cyber security and IP theft incident. Matt also walks us through the forensic dead-ends, poor device management, and missed logging opportunities that left this company exposed.
📌 Topics we cover: – Why unmanaged devices are a ticking time bomb – The hidden value of M365 compliance features – What data is actually worth protecting
Follow us on our channels:
Not all cybersecurity incidents in Australia come with red flags. Some quietly unravel, leaving you with no answers — and no evidence.
Welcome to Part 2 of our Cyber Horror Stories series. This week, cybersecurity expert Matt O’Kane returns with a story about a suspected insider threat, a factory reset laptop, and how a lack of device and Microsoft 365 management left an Australian company flying blind.
If your business operates in Sydney, Melbourne, Brisbane or anywhere across Australia — and you’ve shifted to hybrid or remote work — this one’s for you.
In early 2020, as COVID-19 forced businesses across Australia to go remote, a well-known brand told staff to “get what you can” when it came to devices. Stock shortages were hitting everyone.
One marketing director grabbed a MacBook from a local retailer. But because the device wasn’t purchased or provisioned by the company’s IT team, it never:
This was a critical misstep that would come to bite them much later.
Fast forward nine months after the marketing director’s dismissal, and the business received a tip-off that confidential information was being quietly circulated.
There were no obvious signs of data exfiltration. But in Australia, intellectual property (IP) theft doesn’t often happen with blunt force. It’s more subtle, like with:
And in this case? There was no way to confirm or deny anything.
When Matt was brought in to investigate, his team quickly hit two major roadblocks.
The MacBook had been returned — but factory reset. With no endpoint management, there was no record of file access, downloads, or transfers.
Due to the business’s basic Microsoft licensing, audit logs had only been retained for 30–90 days. By the time suspicions were raised, the digital trail had vanished.
Without logging or forensic access, it was legally impossible to request inspection of personal devices.
Many Australian SMEs (small to mid-sized enterprises) assume all Microsoft 365 plans are created equal.
But here’s the catch: the cheaper licences don’t include long-term logging, compliance tools, or DLP (Data Loss Prevention).
Matt often hears business owners say:
“Why would I pay $80 per month when I’m getting Word and Outlook for $10?”
The answer: you’re not just paying for Office — you’re paying for control, accountability, and legal protection.
This story is a cautionary tale not just about cybersecurity controls, but about how often businesses underestimate their own IP.
It’s not just patents and designs because IP includes:
Once these assets leave your environment, they’re gone. And competitors know exactly how to use them.
This incident could have been prevented with some simple, proactive security practices. Here’s where many companies fall short:
Unmanaged laptops = zero visibility. Any device used for work should:
Cheap licences come at a cost:
Even basic DLP features in Microsoft 365 can:
Many growing businesses don’t know:
If you receive a tip-off, you’ll need to act fast and with purpose.
But first, ask yourself:
If the answer is “no” to any of the above then you’re not ready. And once the trail goes cold, there’s little you can do to recover it.
“You can’t always solve the case. Sometimes, the best investigation is simply good preparation.” – Matt O’Kane
This isn’t about creating a paranoid culture, it’s about sensible, well-scoped controls that let your team work freely and without leaving your organisation exposed.
Review your:
Identify:
Use Microsoft Purview or your MSP to create:
Include:
In Australia, you may be subject to Notifiable Data Breach (NDB) requirements, especially if personal information is involved.
Whether it’s a former employee walking out with a client list or subtle sharing of internal sales materials, IP theft is a serious risk to mid-sized Australian companies.
What’s worse is when it happens quietly, without ransomware or alerts, and without evidence to pursue any further action.
You can’t control what people do once they leave your business. But you can control:
When in doubt, ask yourself:
“If this happened to us, could we prove what did or didn’t occur?”
If not, it’s time to take action.
In the final chapter of this series, we’ll explore a high-impact incident that nearly destroyed a business’s reputation — all because of a vulnerability they didn’t even know existed.
Our Cyber Health Check is designed for mid-market businesses across Australia, helping you:
Available in:
Sydney | Melbourne | Brisbane | Perth | Adelaide
Let’s make sure your business doesn’t end up in the next Cyber Horror Story.
IT Consulting
Cloud Migration Services
IT Infrastructure Projects
Business Continuity Planning
IT Procurement
Managed IT Services
IT Support Services
Managed Cloud Services
End User Computing
Unified Communications
Connectivity
Virtual CIO
Managed Security Services
Cybersecurity Risk Assessment
Cloud Backup and Disaster Recovery
Cyber Security Connect and Protect Program
IT Strategy
Digital Transformation
Microsoft 365 Consulting Services
SharePoint Consulting Services
Power BI
Awards and Certifications
Management Team
Client Case Studies
Our Commitment to the Environment
CSAT Charity Donations
Media Kit
Sydney
