INVESTIGATION · ISSUE 13

Tesla's insider breach is one of the cleanest case studies in the limits of conventional endpoint security. The two individuals had legitimate credentials. They were inside the offboarding window. Standard data-loss-prevention rules treat that activity as authorised. No alerts fired.

Tesla learned about the exfiltration from Handelsblatt, the German publication that received the documents. By then the data had been in unauthorised hands for months.

What was taken

Per Tesla's notification to the Maine Attorney General in August 2023, the breach included personally identifying information for 75,735 current and former employees, customer bank details, production secrets, and internal complaints about Full Self-Driving software. Total volume was reported at roughly 100 gigabytes across more than 23,000 internal documents.

Why endpoint security missed it

Most endpoint DLP rules are tuned to surface anomaly: an unusual destination, an unusual time of day, an unusual file type. Insider exfiltration during the offboarding window does not look anomalous, the user is logging in from their normal device, on their normal hours, accessing files they have always had permission to read. The signal is in the volume and the intent, not the act.

What a session level forensic record would have shown

A hash chained record of every file read, every USB device attached, and every network destination during the offboarding window would have produced two artefacts. First, an attributable timeline that survives any later denial. Second, a measurable spike, 100GB does not move silently when each event is committed to a tamper evident chain. The detection window changes from months to the same business day.

The control is not preventative, a determined insider with legitimate access can still copy files. The control is evidentiary. Without it, the organisation has no answer to a regulator or a court when the question becomes, “what exactly left the building, when, and to where.”