Trade Secret Stolen? What to Do First

A trade secret can take years to build and seconds to lose. When a departing engineer syncs a source-code repo to a personal drive, or a vendor quietly hands your customer list to a competitor, the damage compounds by the day. What you do in the first hours often matters more than anything you argue months later in court. This guide walks through trade secret misappropriation — what it legally means, the first-72-hours playbook, the emergency and criminal tools available, and the clock you’re racing.

What legally counts as trade secret misappropriation?

Misappropriation is a specific legal term, not just “someone has my information.” Both the Defend Trade Secrets Act (DTSA) — codified at 18 U.S.C. § 1839(5) — and the Uniform Trade Secrets Act (UTSA), adopted in some form by every state except New York, define it two ways:

• Improper acquisition. Acquiring a trade secret through improper means — theft, bribery, misrepresentation, hacking, or breach of a duty to maintain secrecy. Someone who knows or has reason to know the secret was obtained this way is also on the hook.
• Improper disclosure or use. Disclosing or using a trade secret without consent when you acquired it improperly, or knew it came from someone who did, or knew you had a duty to keep it secret.

The classic pattern is a departing employee who downloads confidential files and uses them at a new employer, or a business partner who received information under an NDA and then exploits it.

Two things are not misappropriation. Reverse-engineering a product you lawfully bought is fair game. So is independent development — if a competitor arrives at the same result on their own, you have no claim. This is the fundamental trade-off of choosing secrecy over a patent, which we cover in patent vs. trade secret. Before you can prove misappropriation, you must also prove the information was a protectable trade secret in the first place — meaning you took reasonable measures to guard it. That threshold is the subject of the trade secret protection playbook, and it’s the element defendants attack first.

What should you do in the first 72 hours?

Emergency relief rewards speed and punishes delay. Here is the playbook for the critical opening window.

1. Preserve evidence — before anything is overwritten. This is step one and the one people botch. Do not let a suspected employee “clean up” a laptop or return it to the IT pool for reimaging.

• Forensically image relevant devices — laptops, phones, and any personal drives you can lawfully access — using a qualified forensic examiner so the copy is defensible in court.
• Pull and lock down logs immediately: file-access records, download and export logs, VPN and badge logs, email, cloud-storage activity (Google Drive, Dropbox, GitHub), and USB-insertion history. Many of these overwrite on a rolling basis, so hours matter.
• Issue a litigation hold internally to suspend any auto-deletion of email and logs.

2. Map exactly what was taken. Identify the specific files, repositories, or data sets involved, who accessed them, and when. Courts require you to identify your trade secrets with particularity — vague claims that “confidential information” was taken get dismissed. This mapping also drives your damages theory later, which we break down in trade secret damages and remedies.

3. Send a preservation and cease-and-desist letter. Where appropriate, notify the individual and any new employer in writing: demand they preserve all relevant devices and data, stop using or disclosing your information, and return it. This puts the new employer on notice — which matters, because a party who knows it holds stolen secrets and uses them anyway is itself liable.

4. Call litigation counsel immediately. Do this in parallel, not after. Experienced trade secret litigators move within days, and the strength of an emergency motion depends heavily on the evidence you preserved in steps 1–3.

How do you get a court to stop the theft fast?

The most valuable early remedy usually isn’t money — it’s an injunction that stops the secret from spreading before it’s too late. Under Federal Rule of Civil Procedure 65, there are two emergency tools:

• Temporary restraining order (TRO). A short-term order, sometimes granted within days, to freeze the status quo — for example, barring a former employee from using your files or starting a competing project. A TRO can be issued with very limited notice and typically lasts up to 14 days.
• Preliminary injunction. A longer order that holds through the litigation. To win one, you generally must show a likelihood of success on the merits, irreparable harm, that the balance of hardships favors you, and that an injunction serves the public interest.

Irreparable harm is the linchpin — and it’s exactly where delay kills you. If you waited weeks or months after discovering the theft, the defendant will argue there was no real emergency. That is why the 72-hour playbook and the emergency motion are two halves of the same strategy. Injunctions under the DTSA can restrain actual or threatened misappropriation, but note one federal limit: an injunction cannot flatly prevent someone from taking a new job — it can only restrain the use of your secrets, and any employment condition must be based on evidence of threatened misappropriation, not merely what a person knows.

What is DTSA ex parte seizure, and when does it apply?

The DTSA created a remedy no prior law offered: a civil seizure order under 18 U.S.C. § 1836(b)(2). On your application — filed ex parte, meaning without notifying the defendant — a court can order federal marshals to seize the property holding your stolen trade secret, such as a laptop or server, to prevent it from being propagated or destroyed.

This is deliberately extraordinary and rarely granted. You must show, among other things:

• That an ordinary injunction or restraining order would be inadequate because the target would evade, avoid, or otherwise not comply;
• Immediate and irreparable injury if seizure isn’t ordered;
• That you’re likely to succeed in showing misappropriation;
• The specific matter to be seized and, as far as reasonable, its location; and
• That you haven’t publicized the request.

The order must set a hearing within seven days, and the court requires you to post security to cover wrongful-seizure damages. If the seizure turns out to be unjustified, the target can recover damages, lost profits, and attorney’s fees — and punitive damages for bad-faith applications. In short: it’s a scalpel for genuine flight-or-destruction risk, not a first move. Most cases proceed through a standard TRO and preliminary injunction instead.

Can trade secret theft be a crime?

Yes — and this is a lever many victims overlook. The Economic Espionage Act of 1996 (EEA) makes trade secret theft a federal crime, prosecuted by the Department of Justice:

• 18 U.S.C. § 1832 covers ordinary commercial theft of trade secrets. Individuals face up to 10 years in prison and fines; organizations face fines up to the greater of $5 million or three times the value of the stolen secret.
• 18 U.S.C. § 1831 covers economic espionage benefiting a foreign government or agent, carrying up to 15 years for individuals and fines up to the greater of $10 million or three times the value for organizations.

A criminal referral is not a substitute for your civil case — the DTSA was enacted in 2016 precisely to give private owners a federal civil cause of action, since the EEA is enforced only by prosecutors. But the possibility of criminal exposure can shape leverage in parallel civil negotiations, and in serious matters (especially foreign-linked theft) reporting to the FBI or DOJ may be appropriate. Discuss timing carefully with counsel, because a criminal investigation can complicate or stay your civil discovery.

How long do you have to sue?

The clock is shorter than people expect. Both the DTSA (18 U.S.C. § 1836(d)) and the UTSA set a three-year statute of limitations. Critically, it runs from when the misappropriation was discovered or, through reasonable diligence, should have been discovered — not necessarily when it happened.

Two nuances matter:

• Continuing misappropriation is one claim. A continuing course of misuse is treated as a single act of misappropriation for limitations purposes. You cannot reset the three-year clock with each new use, so sitting on a known problem is dangerous.
• The DTSA only reaches conduct on or after May 11, 2016 (its enactment date), though acts continuing past that date can qualify.

Beyond the hard deadline, delay quietly erodes everything else: logs get overwritten, the “emergency” justifying a TRO evaporates, and a court may find the harm was never truly irreparable. Speed protects both your evidence and your remedies.

What remedies can you recover?

Once you establish misappropriation, the DTSA and state law offer real teeth — the full menu is detailed in our guide to trade secret damages and remedies, but in brief:

• Injunctive relief to stop ongoing or threatened use and disclosure.
• Actual damages for your loss plus the defendant’s unjust enrichment not already counted, or — in the alternative — a reasonable royalty for the unauthorized use.
• Exemplary (punitive) damages up to two times the compensatory award for willful and malicious misappropriation.
• Attorney’s fees for willful and malicious misappropriation (and, conversely, against a plaintiff who brings a bad-faith claim).

To preserve DTSA exemplary damages and fees against employees and contractors, your confidentiality agreements must include the DTSA’s whistleblower-immunity notice — a detail covered in the NDA that holds up. Miss that notice and you lose the enhanced remedies against that person, even in a strong case.

The bottom line

Trade secret misappropriation is a race against time on two fronts: the evidence that’s overwriting itself and the three-year clock. The moment you suspect theft, preserve and image devices, pull the logs, map precisely what was taken, send preservation and cease-and-desist letters, and get litigation counsel moving toward a TRO or preliminary injunction. Reserve DTSA ex parte seizure for genuine flight-or-destruction risk, and consider whether the Economic Espionage Act’s criminal exposure belongs in your strategy. Above all, move fast — because the same delay that lets a secret spread is the delay a court will point to when it decides your harm wasn’t urgent after all. For real-world examples of how these disputes play out, browse our trade secret case analysis archive.

This guide is general education, not legal advice, and does not create an attorney-client relationship. Emergency trade secret relief is deadline-driven and turns on your specific facts and jurisdiction — consult an attorney licensed in your jurisdiction before acting.