An SK hynix employee printed eight documents and photographed 5,900 pages on his way to a Chinese rival

SK hynix Inc., the world's second-largest memory chipmaker, saw one of its own employees carry its most sensitive image sensor technology out the door in February 2022, and it took until 1 September 2026 for South Korea's Supreme Court to close the case for good. The employee, identified in court filings only as A, was working as an expatriate staff member at SK hynix's Shanghai sales office at the time. While preparing a resume to apply for a position at a Chinese competitor, A removed the company's trade secret materials without authorisation.

The scale of what A took became clear once investigators reviewed the case. A printed eight confidential documents running to 186 pages, then separately photographed a further 170 documents totalling 5,900 pages. The material centred on SK hynix's CMOS image sensor process technology, the light-detection technology used in smartphone cameras, self-driving vehicle sensors and medical imaging equipment. A also attempted to remove material related to SK hynix's hybrid bonding technology, a next-generation chip-joining process, though the courts ultimately found that portion of the case did not meet the legal threshold for protected advanced technology.

No credential was phished and no external firewall was breached to get this material out. A already had the access needed to see it, and simply exercised that access for a purpose the company had never approved. The appellate court was explicit about why the theft succeeded, finding that A had exploited "the relatively lax security environment" at the Shanghai sales unit, a satellite office evidently held to a lower standard than SK hynix's domestic facilities.

South Korea's courts treated the case as more than an internal personnel matter. The trial court, the appellate court and finally the Supreme Court all upheld the same sentence, with judges repeatedly stressing that leaking core technology to an overseas competitor damages not just one company but national competitiveness. SK hynix is far from alone in facing this exposure. Insider incidents involving employees preparing to leave for competitors, contractors extracting data before contracts end, and workers exploiting access nobody thought to revoke have been rising through 2026, a trend serious enough that the United States Cybersecurity and Infrastructure Security Agency has an updated Insider Threat Mitigation Guide addressing exactly this pattern of risk, covering how organisations define, detect, assess and manage insiders before they act.

The defences at SK hynix's Shanghai office existed. They were built for the wrong threat. Standard information security assumes the danger arrives from outside the perimeter: a stolen password, a phished login, an exploited vulnerability. A needed none of that. A was inside the perimeter already, with legitimate access to the documents in question, and the printing and photographing of those pages looked, to any conventional monitoring tool, exactly like routine work.

This is precisely the blind spot GoFirm closes. Printing, photographing, exporting or bulk-copying classified technical documentation is a high-impact action regardless of whether the person doing it holds valid credentials. Before that export can complete, a real-time confirmation request goes out-of-band to the named authority responsible for that data, a technology lead, a security officer, a data custodian, requiring a biometric confirmation on their own registered device before the action is permitted to proceed.

An employee preparing to hand technology to a competitor, however legitimate their day-to-day access looks, cannot produce that confirmation on someone else's registered device through a separate channel. The execution boundary holds regardless of whether the person attempting the action is an outside attacker or a trusted insider standing at their own desk.

GoFirm is The Authority Platform. Stop unauthorised action. Every time.

In association with Osinto.ai, the collective intelligence and governance network for Security, Resilience & Defence teams.

References

1. Kim, Y. 2026. Ex-SK hynix worker jailed for leaking chip secrets to China. Seoul Economic Daily, 1 September 2026.
2. Cybersecurity and Infrastructure Security Agency. 2026. Insider Threat Mitigation Guide. CISA, 2026.