Why it matters for defenders: this is an insider case where the access that made the theft possible was administrative, not analytic. Privileged IT staff can usually read far more than their job requires. Controls worth checking: separate admin rights from read access to the data itself, log and review bulk reads or exports by admin accounts, require two-person approval for moving data off classified or sensitive systems, and watch for removable-media or print activity that doesn't match a ticket.