This walkthrough gives the answer away on purpose. Read it once to learn how the evidence works, then play a fresh case for real.
Cobalt Health Networks, a hospital IT group
A patient-contact database appeared for sale, and the export used a service account nobody owned.
CLUE 1
How you surface it: Query authentication logs for non-human accounts used interactively.
Why it points at the insider: Service accounts should never log in like people. When they do, a person is driving.
CLUE 2
How you surface it: Resolve the session source addresses.
Why it points at the insider: Third-party risk is insider risk. Contractors sit inside your trust boundary.
CLUE 3
How you surface it: Diff current query patterns against the account's historical baseline.
Why it points at the insider: The longer an account has existed unchanged, the louder any change should be.
CLUE 4
How you surface it: Request contractor timesheets through vendor management.
Why it points at the insider: Administrative records place a specific human at the keyboard.
Anton Weiss is the insider. Motive: Financial pressure from a failing side business. Method: A shared integration service account nobody had rotated in four years.
Timeline: Day -90 contract renewed with broad access; Day -40 first bulk SELECT outside business hours; Day -25 export written to a vendor SFTP; Day -10 access review flags the account; Day 0 listing appears.