How one unmonitored laptop cost a logistics company ₹47 lakh
A 300-person freight forwarding company outside Mumbai lost a customer worth ₹47 lakh a year. The leak had walked out fourteen months earlier, on a company laptop nobody was watching.
This is a data breach case study from India, and the uncomfortable part is how ordinary it was. No hacker, no ransomware note. One key-accounts manager, one company laptop, and no one reading what left it before it was wiped and handed to a new joiner.
The account that walked was worth ₹47 lakh a year. The rate card and the customer list reached a competitor who matched the number line by line and won the contract. The laptop had been reissued months before anyone thought to ask what was on it.
Revoking a login is the visible half of an exit. The copy already made is the half that costs you. Read the USB and export trail before you wipe the machine, not after the customer calls.
11:50 on a Tuesday, and Farhan was not calling about a laptop. He runs a 300-person freight forwarding company outside Mumbai, two people in the whole IT function, and he had just lost his second-largest customer to a rival who quoted a rate no outsider should have been able to guess. He wanted to know one thing. Had he been hacked.
The honest answer took us four days to reach, and it was worse than a hack, because a hack he could have reported and moved past. What had happened instead was quiet, legal-looking on the surface, and entirely his own house. It is the most common shape of data loss we see in Indian mid-market firms, and almost nobody budgets for it.
The call that started this data breach case study
Farhan's customer had been decent about it. Before switching, the customer told him plainly that the competing quote had matched his own rate card, lane by lane, down to the fuel surcharge slab. That is not a coincidence you can price your way out of. Rate cards in freight are the whole game. They are built over years of volume negotiation, and they sit in a spreadsheet that a dozen people can open.
His first instinct was the right instinct, and also the wrong one. He assumed an intrusion, called his firewall vendor, and asked them to check the logs. The firewall was clean. Nothing had come in. That is the trap. Antivirus and firewalls watch for things arriving. The finding that sinks you is almost always about data leaving, and there was no dashboard in the building pointed at the door marked out.
How one unmonitored laptop leaks a customer database
We walked the timeline backwards from the leaked rate card. It led to a key-accounts manager who had resigned about fourteen months earlier and joined, after a short gap, the exact competitor now holding the account. Arre, at that point the shape of it was obvious to everyone in the room except the two who had processed his exit.
His exit had been clean by the company's own checklist. Laptop collected. Email disabled the same day. ID card returned. The laptop was wiped, reimaged, and handed to a new joiner within the week, which felt like good asset hygiene and was actually the destruction of the only evidence anyone would ever have wanted. Nobody had read the USB history. Nobody had pulled the export log from the operations system. There was no endpoint monitoring on that machine, so there was nothing to read even if someone had thought to look.
I want to be honest about my own first mistake, because the mistake is the lesson. When I first read their asset register, I saw the reassigned-laptop line as housekeeping and moved past it. It was not housekeeping. It was the whole story. A customer master and three rate-card sheets had been copied to a USB drive in the manager's last week, the way a resignation copies things, quietly, on a machine no one was watching. If you want the mechanics of how this happens on ordinary hardware, we wrote them up in how employees steal company data and in a longer piece on USB data theft prevention for Indian companies.
Was this a reportable data breach under the DPDP Act?
Here the story stops being only about a lost contract. That customer master did not hold lane rates alone. It held consignee names, phone numbers, GST identifiers and KYC details, which is personal data, which makes the company a data fiduciary with a duty to know where it went. Under the Digital Personal Data Protection Act, 2023, published by MeitY, the penalty for a failure to guard personal data runs up to ₹250 crore, a ceiling laid out in the Act's penalty schedule and summarised in plain terms by PRS Legislative Research. The framework Farhan needed was not exotic either. The access-control discipline in ISO/IEC 27001 would have flagged the export right long before the exit.
The commercial loss was the sharper cut this time, but the regulatory exposure was real and would have sat with Farhan personally. As I told him, and as I say out loud on every call because it costs us nothing to be straight, you are the fiduciary whether or not you have the log to prove it.
What the ₹47 lakh actually was
When Farhan asked what a fix would have cost against what the gap cost, the table wrote itself. This is the part that stings, because the control side of it is small.
| What the gap cost | What the control would have cost |
|---|---|
| One account, about ₹47 lakh a year in freight billing, gone to a rival | USB and export monitoring on the fleet, a fraction of one month of that account |
| A copy made in the leaver's last week, unseen for fourteen months | An export log read once a month, about an hour of someone's time |
| Evidence destroyed when the laptop was wiped and reissued | A data step in the exit checklist, done before the wipe |
| Personal data exposure carrying up to ₹250 crore under the 2023 Act | An October access review that cuts export rights nobody needs |
| Weeks of Farhan and two IT staff chasing a ghost through firewall logs | A first-round findings document in about one working day |
What we told the freight company to do next
Farhan's next line was the one we hear most. We have never had a breach, so why would this happen to us. Here is the honest answer we gave, the same one in our objections notes. Most companies have not had a breach they know about, which is a different sentence from not having had one. Data does not leave with an alarm. It leaves quietly on a resignation, a USB, or a personal email, and you find out when a customer or a regulator tells you.
His second line was the other one we hear. Fine, we will just handle the monitoring ourselves. Also fair, and some firms do it well. But a control nobody watches is not a control, it is a false sense of safety. The day the tool fires an alert is the day it matters who is actually watching, and for a 300-person firm with two IT staff and a rush every festival season, that person has to be named or the alert dies in an inbox.
So we did not sell him a suite. We started with two cheap things his own systems already held, the USB history on the endpoints and the report-export log in his operations software. For DLP-led data protection scoped to what an Indian mid-market firm actually needs, Sirius Star Enterprise Technologies is the specialist we would point Farhan to, and we said as much while telling him which modules to skip. If you are weighing whether you are even in the zone where this pays off, our note on DLP for small business under 100 employees draws the honest line, and the fuller method sits under Secure Data Guard, our data protection practice.
How to run this check on your own fleet
Start before the resignations arrive, not after a customer calls. Pull ninety days of report exports from your operations or accounting system and read the names against your customer data, then list everyone who can export customer records at all and cut the rights nobody uses. In 17+ years we have seen that export list hold more names than any owner expects, every single time.
Then add one data step to every exit, done before the laptop is wiped. Read the leaver's last thirty days of USB activity, external shares and mail-forwarding rules, and write one line on what they could touch and what you checked. It feels like bureaucracy until the afternoon a customer asks how the rival got your rate card, and then it is the only document that matters. If you want the number behind all this, our breakdown of what a data breach costs an Indian mid-size company does the maths, and the plain-language ground floor is our no-jargon guide to data loss prevention.
What to take away
- The leak walks out on an ordinary exitNo hacker is needed. A resignation, a USB, and a laptop nobody read before wiping it will do the whole job.
- Firewalls watch the wrong doorThey guard what comes in. The finding that costs you is data going out, and most estates have nothing pointed that way.
- Your export log is the cheapest control you ownIt already sits in your operations software. Reading it monthly catches the copy that left before anyone asks.
- Revoking access is not data protectionIt stops the future. An exit is mostly about the copy already made and the share still open.
- A tool nobody watches is not a controlName the person who reads the alert, or the alert dies in an inbox and the false sense of safety costs more than no tool at all.
Four terms in this piece, in plain English
- Data fiduciary
- The DPDP term for the organisation that decides why and how personal data is handled. If it is your customer master, the duty to know where it went is yours, log or no log.
- Export log
- The record your ERP or operations system keeps of who pulled which report, and when. Almost every system has one. Almost nobody reads it until after something has gone wrong.
- Endpoint DLP
- Monitoring that sits on the laptop itself and records what leaves it, including USB copies, uploads and screenshots. It is the door firewalls do not watch.
- Access review
- A periodic check of who can reach or export what, so rights that are no longer needed get removed before a leaver takes them out the door.
Questions Farhan wished he had asked earlier
We have never had a breach. Why would this happen to us?
Most companies have not had a breach they know about, which is a different sentence from not having had one. Data does not leave with an alarm. It leaves quietly on a resignation, a USB, or a personal email, and you find out when a customer or a regulator tells you. The point of monitoring is to see it while it is happening, not to read about it a year later in a rival's quote.
Can we legally check what a departing employee copied to a USB?
On a company-owned and company-issued laptop, reasonable logging for employment purposes sits inside what the DPDP framework allows, provided people were told clearly and you collect no more than the purpose needs. On a personal phone the answer is effectively no. Publish an acceptable-use note, get it acknowledged, and keep monitoring to assets you own. This is not legal advice and your counsel should see the wording.
Is a leaked customer list a reportable breach under the DPDP Act?
Possibly. If the list held personal data such as names, phone numbers, GST or KYC, that is the category that turns a lost file into a reportable question. Contain it first: ask for deletion in writing, revoke any shares the person created, and write down what left and when. Then take that record to your data protection officer or counsel, because that record is what the Board will ask for.
We are 300 people with two IT staff and a rush every festival season. Where do we start?
Two jobs, both cheap. Read ninety days of report exports and see who pulls customer data. Then run an access review and cut export rights nobody needs. Between them they take about a working day and remove most of what a first-round assessment would find. Buy tooling after that, once you know your own leak route.
Related reading
- How employees steal company data: 5 methods most Indian companies cannot detect
- USB data theft prevention for Indian companies
- What a data breach actually costs an Indian mid-size company
- What is data loss prevention (DLP)? A no-jargon guide for Indian businesses
- Secure Data Guard, our data protection practice
A read-only check across a sample of your endpoints and your operations system: ninety days of report exports read against your customer data, plus the USB activity, external shares and mail-forwarding rules left open by people who have already gone. You get a written findings document: who touched what, what is still live, and the two changes that cost you nothing.
Farhan did not win that account back, and I am not going to write an ending where he did. What he got was quieter. The next quarter, when a warehouse supervisor resigned, his IT lead pulled the export log first, found nothing, wrote his one line, and then wiped the laptop. Theek hai. Sometimes the whole win is that the second exit is boring.
Obligations, monitoring grounds and penalty ranges follow the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 as they stood at the time of writing, and all of that can change. The engagement described is one anonymised client matter with identifying details changed. A practitioner note on operating practice, not legal advice.
