If recent editions highlighted targeting and the misuse of trusted authority, October raises another important question: what happens to insider risk when employment ends, but relationships, knowledge and influence remain?
This month’s incidents illustrate that insider risk does not only occur during employment, but can extend beyond an employee’s offboarding, and be influenced by external relationships and threat actors.
Let’s get into it.
On 6 October, German authorities arrested former BND president August Hanning and his former chief of staff, identified as Manfred D. Prosecutors allege that Manfred D. supplied August Hanning with nearly 2,000 BND documents over a period beginning in 2010, including classified information intended for internal intelligence purposes.
Former German spy chief arrested for treason and espionage – POLITICO
According to prosecutors, August Hanning allegedly used classified information received through Manfred D. to prepare an assessment for an officer of a foreign intelligence service. The foreign intelligence service has not been publicly identified, and reporting said it remained unclear whether the information ultimately reached its intended recipient. August Hanning denies the allegations.
European intelligence services weigh possible fallout after German ex-spy chief's arrest | Reuters
From an insider risk perspective, the significance lies in the alleged mechanism of compromise. August Hanning had left the BND years earlier, while prosecutors allege that a relationship with someone who remained inside the organisation allowed sensitive information to continue flowing outside it.
This is precisely why insider risk needs to be considered across the entire employee lifecycle.
European intelligence services were also examining whether information previously shared with Germany might have been compromised following the arrests, according to Reuters.
Insider risk lesson: Access may expire, but knowledge and trusted relationships do not necessarily disappear when someone leaves an organisation.
Another German case this month illustrates a different side of the insider risk equation: the targeting of people who already have access to valuable information.
On 22 October, German authorities arrested a Ukrainian national, identified as Vadym Y., in Brandenburg on suspicion of spying for Russia. Federal prosecutors said he had been in contact with a Russian intelligence service through an intermediary since at least July 2025.
Suspected spy for Russia arrested in Germany | Reuters
Prosecutors allege that he gathered military-related intelligence, including information concerning the production of armoured vehicles, ammunition and explosives, as well as personnel and installations involved in securing NATO’s eastern flank. While some of the information was publicly available, prosecutors said that other details were solicited from individuals within the European defence industry.
This case provides an important reminder that insider risk does not always originate with a malicious employee acting independently. An external actor may seek information through people who already have legitimate knowledge, relationships or organisational access.
For organisations operating in defence, critical infrastructure and other sensitive sectors, understanding who may be attractive to hostile actors is therefore an important component of insider risk management.
Insider risk lesson: Organisations need to understand not only who has access to valuable information, but also why those individuals could become targets for external actors.
Insider risk is often associated with digital access, data theft or unusual activity on corporate systems. A case involving OpenAI this month demonstrates why the physical environment matters too.
A 35-year-old OpenAI engineer was arrested in the United States on 9 October after a hidden recording device was discovered in an executive conference room at the company’s San Francisco offices. According to reporting citing US Department of Justice information, the device had allegedly been placed in a room used for sensitive technical, commercial and strategic discussions.
Former OpenAI Employee Charged with Bugging Executive Conference Room
OpenAI stated that at the time it had no indication that model weights, source code or customer data had been improperly accessed or exfiltrated. This distinction is important: the confirmed allegations concern an attempt to intercept conversations rather than confirmed theft of those digital assets.
Saudi OpenAI employee arrested after recording device found in headquarters | OpenAI | The Guardian
From an insider risk perspective, the case illustrates the connection between physical security and information security. Sensitive organisational information does not exist exclusively in databases, email inboxes or document repositories. It is also discussed in meetings and other physical environments that trusted employees can access.
Insider risk lesson: An effective programme needs to consider physical access alongside digital privileges, particularly where employees work with sensitive intellectual property, strategic information or executive decision-making.
Reporting alleged that digital-forensics company Oxygen Forensics, whose technology has been used by European law-enforcement agencies and EU-funded projects, concealed Russian ownership and development links while presenting itself as a US-based supplier. The case raises questions about transparency around the ownership, development and control of technology used in highly sensitive investigative environments.
Russian tech surveillance company infiltrated Europe’s law enforcement agencies – POLITICO
Digital-forensics vendors can occupy particularly trusted positions. Their technology may be used to collect, process and analyse sensitive information and can become embedded in evidence-handling and investigative workflows. This means that risk may extend beyond the direct supplier to its owners, developers, subcontractors and other organisations that can influence the technology or service.
Importantly, the available reporting does not provide evidence that Oxygen Forensics compromised customer systems or transferred customer data. The insider-risk relevance lies instead in the visibility problem the case exposes: an organisation may trust a supplier without having sufficient insight into who ultimately owns it, who develops its technology and who may exercise influence further down the supply chain.
Insider risk lesson: from an insider-risk perspective, third parties can effectively become the “forgotten insider.” Suppliers and contractors may receive legitimate access to sensitive systems, data and operational processes, while sitting outside the organisation’s traditional employee-focused controls and oversight.
Read our full analysis here: The Oxygen Forensics case and the limits of third-party visibility
A fourth European development from October is not a confirmed malicious-insider case, but it is relevant to the broader conversation around identity, access and insider risk.
The Technical University of Denmark disclosed a serious personal-data incident on 2 October involving DTUBasen, its identity and access-management system. Reporting said that data associated with as many as 200,000 current and former users could be affected. The university reported the incident to Denmark’s data protection authority and referred the matter to investigative authorities.
DTU Breach Fallout: Datatilsynet, NSK Probe Open [2026]
At the time of the available reporting, there was no confirmation that an employee or other malicious insider caused the incident, so it should not be treated as a deliberate insider attack.
Nevertheless, the incident highlights an important component of insider risk management: identity and access. Managing accounts, permissions and user identities is closely connected to controlling who can reach sensitive organisational information throughout their relationship with the organisation.
For organisations, the broader lesson is to look beyond individual behaviour and consider whether the underlying identity and access environment supports effective management of insider risk.
Insider risk lesson: Identity and access management provides part of the foundation for managing insider risk across the employee lifecycle.
Eight dockworkers at the Port of Algeciras were arrested as part of a major cocaine trafficking investigation. The case is particularly relevant from an insider-risk perspective because the alleged involvement of port employees brought legitimate access and operational knowledge into the criminal operation.
What makes this case significant is that the threat did not come solely from outside the organisation. The individuals allegedly involved already operated within the port environment. Their positions could therefore provide something external actors typically struggle to obtain: legitimate access combined with knowledge of how the operation works.
Eight dockworkers arrested in Algeciras cocaine operation - Port Technology International
The case highlights an important distinction: authorised access does not automatically mean trusted activity.
Insider Risk lesson: physical security is often designed around preventing unauthorised individuals from reaching sensitive locations. Insider risk presents a different challenge. Employees, contractors and other trusted individuals may already have legitimate reasons to access restricted environments, systems or information.
Think beyond employment. Offboarding credentials addresses one component of risk, but relationships and organisational knowledge can continue after an employee has departed. The allegations in the German BND case illustrate this particularly clearly.
Consider external targeting. People with specialist knowledge or access to strategically valuable information can themselves become attractive sources for external threat actors, as illustrated by the allegations surrounding Vadym Y..
Connect physical and digital security. The OpenAI case is a useful reminder that sensitive information can be exposed through the physical environment as well as through corporate systems.
Treat access as a lifecycle issue. Identity and access controls form an important part of managing organisational access as people join, change roles and eventually leave.
Ultimately, October’s developments show why insider risk cannot be reduced to monitoring employees. It is about understanding and protecting the trusted relationships, access and information that connect people to an organisation throughout their lifecycle.
The cases discussed in this publication are based solely on publicly available information available at the time of writing on 27 October 2026. They are intended for educational and illustrative purposes and should not be interpreted as definitive investigative findings. Some investigations and legal proceedings remain ongoing, and subsequent information may change the understanding of these events.