This is a classic example of IP theft, where an employee moves from one organisation to another and takes intellectual property with them.  In this case, criminal charges have been filed further to a previous civil agreement.

We often see cases such as these, whereby data in various forms and in various ways are taken.  Often it can be complete 'dumps' of an area of the network, or it can be more specific such as source code, database extracts or specific files/folders.  The way the data is taken also varies, sometimes it can be simply emailed to a private email address, but uploads to private cloud accounts and use of USB devices are often commonly used...as well as printing documents and taking photographs of them.

Companies need to be aware that this sort of behaviour takes place and that appropriate actions need to be taken to protect themselves.  They should not only seek to investigate cases when they become aware of them - using a forensic expert where appropriate, but also consider how best to prevent and detect this behaviour from happening in the first place.  If you'd like to know more, our A&M global team has significant experience working on cases just like this...