The Employee You Cannot Sue

June 25, 2026 SupportTrenches Stories & Case Studies 5 minutes

A friend told me this story about a Company that hired a remote support engineer from a country with beautiful beaches and terrible rule-of-law. They worked European hours, had full access to the CRM, and handled tickets for enterprise customers across Germany, France, and the UK. On paper, it was a perfect hire: talented, responsive, and cheap.

After a few months, they noticed an odd pattern. Customer churn was increasing in a way that correlated with this engineer's shift. No obvious cause in the tickets themselves. But an elaborate security audit revealed that a competitor had started approaching their customers with suspiciously accurate knowledge of their infrastructure, decision-makers, and contract terms.

That engineer had been quietly exporting customer data from the CRM during his shift for three months. He just looked into the account data, wrote it in a notepad, typed it back into his personal computer, and then sold it to a shady data broker who resold it to the competitor. The total payout to the engineer was probably a few thousand dollars (or the equivalent in Bitcoin). A fraction of their annual salary.

The company found out. They fired the engineer. They contacted local law enforcement. And then they hit a wall.

The engineer lived in a one-room concrete structure with no running water. They had no assets in their own name. No property. No enforceable contract that meant anything in a local court where the judge could be bought for the equivalent of fifty dollars. The company's legal team spent several months and many thousand dollars trying to pursue the case. They got nowhere. The data was already on the dark web. The competitor had already used it. The customers who left were never coming back for obvious reasons.

The uncollectable judgment

This is the reality that no outsourcing business case captures. Even if you catch the bad actor. Even if you have ironclad contracts. Even if you have perfect background checks (which are really simple to fake in such countries). The legal system of the country where they live simply isn't concerned about your American or European intellectual property or your customer's privacy. They might even appreciate the benefit to their GDP.

You can sue. You might even win. But what are you going to collect? A judgment against someone who owns nothing, has no income you can garnish, and lives in a jurisdiction where enforcement is a fantasy. The local court will take your filing fee, smile, and move on to the next case. Your customer data is already circulating on Telegram channels and hacker forums.

The daily harvest

The scary part is how easy it is. A remote support engineer with CRM access can export the entire customer database in an afternoon. A developer with repository access can zip the whole codebase and upload it to a personal drive. A sysadmin with SSH keys can tunnel out every log file, every config, every internal document. Or they might simply provide access to others who scrape the data manually with a pen and paper, circumventing your thousand-dollar firewall.

They do not need to be sophisticated. They do not need to bypass security controls. They have legitimate access. They are doing their job. It just happens that their job involves copying data that happens to be valuable to someone else. And it already happened a thousand times; it's not a theoretical threat; it's a real vector.

And the temptation is enormous when the alternative is living in poverty. A single sale of customer data can equal years of salary in those countries. The risk is minimal. The payoff is life-changing. The only thing stopping them is integrity, and integrity is hard to maintain when your government does not enforce laws and your neighbors are doing the same thing.

What you are really exporting

When you hire a remote employee in a high-corruption jurisdiction and give them access to customer data, you are not just saving money. You are making a bet. You are betting that this person's integrity is stronger than their economic incentives, stronger than the lack of legal consequences, stronger than pressure from local criminal networks or state actors.

Some of them pass that test. Many do not. And you will not know which category your hire falls into until your data is already for sale.

The data of European system administrators, CEOs, and decision-makers is valuable. It tells competitors who to poach, which accounts are up for renewal, what security vulnerabilities exist, who is unhappy with their vendor. That data, once leaked, cannot be un-leaked. It circulates forever. It undermines trust that took years to build.

And for what? A salary arbitrage that amounts to pocket change in the corporate budget.

The next time your CFO proposes replacing a European support engineer with a remote hire from a jurisdiction with weak rule-of-law, ask them one question: "what is the plan when that employee sells your customer database on the dark web?" If the answer is anything other than "we don't allow that access from that location." you are not ready.

The data you gave away today is tomorrow's competitor advantage or a nasty lawsuit against your entire existence. Know who holds your keys.

This article is also available in German.

OutsourcingSecurityInfoSecLegalEuropeManagement