With the right kit and integrations this kind of behaviour is detectable at outset in real time and straight up preventable.
The attacker took critical company data and sent it to his personal Google account, just with a CASB there are at least five vendors that can detect and prevent that out of the box.
Add in the rest of the controls and send them to a good SIEM, and do anomaly detection and properly staff it. Well, probably you’re looking at a 10-20 million dollar investment for a company the size of Google with its assets, however this was not a skilled attacker so you could have been aware from the moment he tried to take the first file, and very likely before. Just a policy preventing transfer of documents to a personal Google Google account would have detected and prevented this.
However as a very good salesman once said:
”No one want’s back-up, everyone wants recovery…”
