How 12,000 Files Left Pfizer Through a Personal Google Drive

Introduction

One Saturday in October 2021, a Pfizer statistician started copying files from her work laptop to her personal Google Drive. On Sunday, she tried to connect an external drive, and the laptop blocked it. The Google Drive uploads weren’t blocked, only logged, and by Tuesday, Pfizer later reported, more than 12,000 files had been uploaded. Pfizer didn't spot the activity until Friday. Pfizer's court filings explain why the two controls behaved differently.

The statistician was a longtime employee, joining Pfizer in 2006.  The complaint alleges no stolen password, escalated privilege, or compromised admin account. She accessed the files using the access her job gave her. She said she never meant to download the files, and no court ruled either way. 

An Offer Before the Uploads

When the uploads began, the statistician already had a job offer from Xencor, a biotech company, according to Brian Coleman, who ran Pfizer's Digital Forensics & Insider Threat Unit. Pfizer found the offer in her work email during its investigation. She gave notice on November 12, 2021, with a last day of November 24.

Most departure-risk rules don't start watching until HR records that an employee is leaving, and by then the files were long gone. A CERT analysis of 48 intellectual property theft cases found well over half the insiders took at least some information within 30 days of leaving. The statistician's uploads started 32 days before her last day.

What Was in the Folders

Pfizer's complaint picks out four documents, and one of its declarations gives the page counts.

• A 101-page "E2E Clinical Development + Submissions Playbook" from September 2021, analyzing "the successes and breakthroughs" of the COVID-19 vaccine studies.
• A 67-page oncology presentation covering several drugs, including elranatamab.
• A 114-page development plan for combining encorafenib and binimetinib to treat melanoma.
• A 23-page case study on dose-finding design in avelumab trials.

Published trial results tell a competitor what worked. A playbook tells them how Pfizer got there, and a development plan shows where it's going next. None of it has the fixed shape a pattern rule looks for, like a card number or a Social Security number, and a fingerprint rule only catches a document someone registered in advance.

A password can be reset, and a credit card reissued within a week. Once copied, a development strategy can't be taken back.

How 12,000 Files Got Out

Pfizer didn't piece the exfiltration together from its own alerts. Its forensic team rebuilt the route over the following weeks from a surrendered laptop, an external drive, and the upload records its systems had already kept.

Files went up to a personal Google Drive, came down to a second computer, and landed on the external drive. Only the first hop happened on a machine Pfizer controlled.

Saturday to Tuesday, Up and Down

The complaint doesn't say whether the uploads went out through a browser or the Drive desktop client. Either way, it is a process: reading files and sending them to Google over TLS.

The external drive told the rest. Windows can tag files downloaded from the internet with a hidden Zone.Identifier stream, commonly called the Mark of the Web. That origin information can carry through when files are extracted from a downloaded zip.

On her drive, Kevin Clarke, a forensic examiner hired by Pfizer, found tags whose ReferrerUrl pointed to about 30 Drive zips in C:\Users\cli\Downloads, his declaration says. The first was stamped 16:23 UTC on Sunday, October 24, while the laptop was still uploading.

If that computer exists, Pfizer never saw it. None of the three devices she handed over had a CLI profile, and the personal laptop she gave Pfizer showed no browser, Drive, or network activity from October 20 to 28, the filings say.

Clarke believes a CLI machine exists, and Pfizer's complaint calls the surrendered laptop a decoy. No court ever ruled on it.

A Refused Drive and Six Days of Logs

The drive the former employee tried on Sunday hit a device-control policy Pfizer had pushed to every laptop in 2019. It refused the connection, and the attempt remained in the laptop's record when examined Coleman, his declaration says.

Pfizer's systems logged the uploads, several thousand entries down to the receiving account, which Coleman said appeared to be her personal one. Pfizer says it uses automated alerts, but none is alleged to have fired, even at roughly 3,000 files a day. Coleman found the entries on Friday while "reviewing data from our systems."

Pfizer planned a supervised deletion. By the second call that evening, Coleman and the complaint say, she had already emptied the Drive and told them so, having said on the first call that she wanted her files offline for her own use.

Why Blocking Google Drive Isn't Simple

Blocking uploads is harder than it sounds because personal and company Google Drive accounts share the same hostnames and certificates. Google's documentation says managed traffic "goes to the same URL as the traffic you want to block." Block the hostname, and you take down your own Workspace.

Google's fix is tenant restriction. A TLS-inspecting proxy, or managed Chrome through the AllowedDomainsForApps policy, adds an X-GoogApps-Allowed-Domains header to Google requests, and Google refuses accounts from any other domain.

It covers only traffic through that proxy or browser, so an off-network laptop, a second browser, or the Drive desktop client can go around it. MITRE's one listed mitigation for T1567.002, Exfiltration to Cloud Storage, is the same idea.

Pfizer's Policy #403 already banned the "[u]nauthorized use of non-Pfizer cloud service accounts for the storage, computation or transfer of Pfizer information." The filings don't say whether anything enforced it on the network.

What It Cost Pfizer

On November 24, 2021, Forbes ran the headline, "Pfizer Sues Employee, Alleging She Stole Covid-19 Vaccine Documents," in the middle of a pandemic. Pfizer said its vaccine playbook and oncology plans had been exfiltrated, and it couldn't say where every copy had gone. 

A Restraining Order, Then Silence

Pfizer got a temporary restraining order on November 23, less than four weeks after spotting the uploads and before the former employee had even been served. She never answered. Within two weeks, her lawyer signed a stipulation saying she wanted "to resolve this action without further Court intervention."

The deal that followed gave Pfizer's outside counsel access to her personal email, Drive, phones, and devices, and required her to swear she no longer held Pfizer's confidential information. On February 23, 2022, the case was dismissed with prejudice, with no payment or admission on the record. The merits fell under a confidential JAMS arbitration clause in her contract, so anything decided would remain private.

The Price of Finding Out

Pfizer spent heavily to learn what it had lost: an internal investigation, an outside forensic firm, an emergency court filing, and weeks of inspecting a departing employee's personal accounts. None of it brought the files back.

Pfizer did a lot right. It banned personal cloud accounts by policy, blocked USB drives on every laptop, and turned on upload monitoring that same month. But the USB block made a decision, and upload monitoring only made a record that someone read six days later.

Pfizer isn't alone in that. Google's own data loss prevention "monitored and logged certain data transfers" while an engineer uploaded confidential files to a personal account for a year, according to his indictment. Google found it about 19 months after the first upload, and he was convicted in January 2026. In both cases, the tooling saw the data leave, and nothing turned that into a decision.

How Our Platform Would Have Seen It

Pfizer's uploads sit on path T3 of our Data Loss Threat Model, and its worked example T3.1 ends the same way, with a file from a company device uploaded to a personal Google Drive.

With our browser extension in place, the first upload on Saturday, October 23, never completes. It sees a personal Google account receiving a 101-page clinical playbook and denies it before the file leaves the laptop.

Nothing reaches Drive, so the rest of Pfizer's week never happens. No relay to a second computer, no zip trail, no six-day wait for someone to read a log.

Our browser extension reads which account is receiving the file inside the browser session, with no proxy or injected header. Our endpoint sensor and Google Drive for desktop integration also watch files moving through synced Drive folders. LLM-based classification recognizes a clinical playbook without a pattern or fingerprint, and it can treat organization-specific data types, such as Pfizer's vaccine data, as higher-risk incidents. Data lineage ties every upload attempt into one record the team sees the same day.

That record is also what Pfizer lacked in court. To protect a trade secret, the owner has to show it took "reasonable measures to keep such information secret," the test Pfizer's restraining-order brief quotes.

Pfizer could point to a policy, a USB block, and a log read six days later, then had to rebuild the rest from zone identifiers and a court-approved deal to reach her devices. With ORION, counsel starts with an audit trail of every attempt, verdict, and file, time-stamped from the first upload.

Conclusion

The USB block worked, and the files went out through a personal Google Drive on the same laptop, an app Pfizer didn't own. That upload is path T3 in our Data Loss Threat Model, a managed device handing data to an unmanaged app, and the same route runs to Dropbox, WeTransfer, or a personal GitHub from every managed laptop. A policy can ban those apps, and a log can record them, but a verdict at the moment of upload is what keeps the file on the laptop. Book a demo and see how ORION stops a sensitive file at the upload, then walk your own unmanaged-app exposure through the model, path by path.

FAQs

How Do You Block Personal Google Drive Without Breaking Workspace?

A hostname rule can't do it, because personal and company Drive share the same URLs and certificates. Google's tenant-restriction header works, but only on traffic through a TLS-inspecting proxy or managed Chrome. ORION's browser extension reads which account is receiving the file inside the browser session instead. Its endpoint sensor and Google Drive for desktop integration also watch files moving through synced Drive folders.

Why Didn't Pfizer's Monitoring Stop the Uploads?

It wasn't built to. Pfizer's systems recorded several thousand upload entries, but no automated alert is alleged to have fired, and a person found them six days later. ORION returns a verdict at the moment of upload, allowing it, warning the user and asking for a justification, or denying it, so the decision happens before the file leaves.

Can DLP Recognize a Clinical Playbook?

Pattern rules can't, because a playbook has no fixed shape like a card number. Fingerprinting only catches documents registered in advance. ORION's LLM-based classification reads the content itself, so it recognizes clinical development material without a classification project first, and the verdict also weighs context, such as whether the file is going to an approved recipient or an unauthorized third party.

How Early Can You Catch a Departing Employee?

Earlier than HR usually can, since data often moves before notice is given. Pfizer's filings say she received a job offer before the uploads began and gave notice more than two weeks after they started, and CERT found that well over half of insiders in its IP theft cases took data within 30 days of leaving. ORION's identity signal weighs activity against the user's own history, so it doesn't wait for a resignation.

What Evidence Do You Need If It Ends Up in Court?

Proof that you took "reasonable measures" to keep the information secret, plus a record of exactly what left. Pfizer had a policy, a USB block, and a log read six days late, and rebuilt the rest from Windows metadata and court-approved device access. ORION's lineage record gives counsel every attempt, verdict, and file from the first upload.

Sources

• Complaint, Pfizer Inc. v. Li, No. 3:21-cv-01980. U.S. District Court, Southern District of California, November 23, 2021.
• Declaration of Brian Coleman (Dkt. 4-11), Pfizer Inc. v. Li. U.S. District Court, Southern District of California, November 23, 2021.
• Declaration of Kevin Clarke (Dkt. 4-10), Pfizer Inc. v. Li. U.S. District Court, Southern District of California, November 23, 2021.
• Declaration of Dan Meyer (Dkt. 4-12), Pfizer Inc. v. Li. U.S. District Court, Southern District of California, November 23, 2021.
• Declaration of T. Smith (Dkt. 4-13), Pfizer Inc. v. Li. U.S. District Court, Southern District of California, November 23, 2021.
• Mutual Arbitration and Class Waiver Agreement (Dkt. 4-5), Pfizer Inc. v. Li. U.S. District Court, Southern District of California, November 23, 2021.
• Temporary Restraining Order and Order to Show Cause (Dkt. 7), Pfizer Inc. v. Li. U.S. District Court, Southern District of California, November 23, 2021.
• Order re Preliminary Injunction and Stay (Dkt. 18), Pfizer Inc. v. Li. U.S. District Court, Southern District of California, 2021.
• Joint Stipulation of Dismissal (Dkt. 26), Pfizer Inc. v. Li. U.S. District Court, Southern District of California, February 2022.
• Pfizer Files Federal Lawsuit Against San Diego Employee. NBC 7 San Diego, November 24, 2021.
• Pfizer Sues Employee, Alleging She Stole Covid-19 Vaccine Documents. Forbes, November 24, 2021.
• Complaint, Pfizer Inc. v. Regor Therapeutics, No. 3:22-cv-00190. U.S. District Court, District of Connecticut, February 2, 2022.
• Former Pfizer Staffers Counter Pharma Giant's 'Belated and Ill-Founded' Trade Secrets Case. Fierce Biotech, March 23, 2022.
• Joint Motion for Suspension of Pretrial Deadlines (Dkt. 170), Pfizer Inc. v. Regor Therapeutics. U.S. District Court, District of Connecticut, May 30, 2023.
• Indictment, United States v. Ding, No. 3:24-cr-00141. U.S. District Court, Northern District of California, March 5, 2024.
• Former Google Engineer Found Guilty of Economic Espionage and Theft of Confidential AI Technology. U.S. Department of Justice, January 30, 2026.
• A Pattern for Increased Monitoring for Intellectual Property Theft by Departing Insiders (CMU/SEI-2012-TR-008). Moore, Hanley and Mundie, Software Engineering Institute, Carnegie Mellon University, 2012.
• Block Access to Consumer Accounts. Google Workspace Admin Help.
• AllowedDomainsForApps Policy. Chrome Enterprise.
• 18 U.S.C. § 1839, Definitions (Defend Trade Secrets Act). Legal Information Institute, Cornell Law School.
• Memorandum in Support of Temporary Restraining Order (Dkt. 4-1), Pfizer Inc. v. Li. U.S. District Court, Southern District of California, November 23, 2021.
• Exfiltration to Cloud Storage (T1567.002). MITRE ATT&CK.

‍