Here's a bit of detail about an internal attack I was involved with: http://boston.conman.org/2004/09/19.1 It wasn't a disgruntled employee---it was an employee who was hired by another party to get hired by the target, spend six months there, and did his thing on a particular date.