Government Contractor Sues Ex-Staffer, Alleging She 'Sabotaged Its Systems'

Alyssha Holdren, former Maximus director-sales operations, began deleting “thousands of Maximus files and data assets” March 1 from Salesforce, the government contractor’s cloud-based customer relationship management platform, the complaint alleged. Holdren also created a system administrator role for a co-worker, limiting that employee’s ability to access and change system settings, said the complaint. That impeded Maximus’ ability to revoke Holdren’s access to Salesforce and view her history log and activities, it said.

Maximus learned on March 3 that Holdren accessed Salesforce two days earlier and began “changing permissions, deleting data [and] emptying the recycle bin," the complaint said. In addition, the complaint alleges she deleted a copy of the company organization known as the sandbox. The next day, it learned Holdren deleted 1,385 emails from her Maximus account plus data installed on an application that can assist with cloning and extracting data from the Salesforce environment, it said. The company learned Holdren obtained Salesforce access through her personal laptop, not a Maximus-issued computer, bought extra storage on her Dropbox account and subscribed to Adobe software, it said.

Between March 1 and 4, Holdren deleted Salesforce recycle bins and the sandbox, which had information Maximus could have used to restore deleted data, the complaint said. On March 6, the company discovered Holdren forwarded “dozens” of emails with Maximus proprietary information to personal email addresses belonging to her and her husband, it said. The information included pipeline and financial forecast information and screenshots of Microsoft Teams conversations with Maximus co-workers, it said.

Maximus terminated Holdren’s employment March 6 in a letter saying her conduct violated company policy. The letter demanded she return all company property not later than Friday, the complaint said. Maximus’ outside counsel sent a letter March 7 demanding that she cease and desist using proprietary company information, return all Maximus material, whether on Dropbox or a third-party storage device and immediately inform the company whether she shared proprietary and confidential Maximus information with a third party, it said. The letter also informed Holdren the company was contemplating litigation against her, the complaint said.

Holdren responded to outside counsel Friday at 4:59 p.m. saying she was “happy to return Maximus’ property” but that she was traveling that day and would ship it when she returned, the complaint said. The other items in the letter “would be addressed by my attorney,” it said. She didn’t provide contact information for her attorney, and as of Tuesday Maximus “has not heard further from Holdren or her attorney and has not received any of its equipment or intangible property,” it said.

Maximus suffered “substantial and irreparable harm as a result of Holdren’s actions,” the complaint said. Her actions caused “significant disruptions” to company operations and compromised “critical, proprietary sales information,” it said. The disruptions could lead to “lost sales opportunities, delayed projects, and reduced productivity,” it said. The company invested “significant time and money” trying to rebuild “lost elements and capabilities” on Salesforce and is experiencing “significant impacts,” including “110 users reporting missing fields, reports, dashboards, and corrupted and broken functionalities,” it said.

Due to the sensitive nature of the information in Holdren’s possession, she could sell it or use it to obtain a job with a competitor, said the complaint. She could cause “significant competitive harm" if the information is disclosed publicly and damage Maximus' relationships with customers and business partners, it said. Holdren’s actions have caused “well over $5,000” in damages and losses to the company, it said.

Maximus asserts claims of breach of contract, breach of loyal duty, and violations of the Defend Trade Secrets, Virginia Uniform Trade Secrets, Computer Fraud and Abuse and Virginia Computer Crimes acts. It demands judgment against Holdren, a temporary restraining order and preliminary and permanent injunctive relief; orders directing Holdren to return all Maximus-owned equipment and information; a cease-and-desist order of any use of Maximus’ confidential and proprietary information; and an order requiring her to submit to a forensic examination of her personal laptop and other devices used to store Maximus information. The company also seeks compensatory and punitive damages and attorneys’ fees.