There have been documented cases of that happening. One story I read, the employee only got found out because there was unusual VPN activity. Such as valid logins from (possibly?) Chinese IPs.