Apple Lawsuit Highlights Risks in Employee Offboarding and Data Access

The complaint says Chang Liu left Apple for OpenAI in January 2026 without returning an Apple-issued laptop. Weeks later, Apple alleges, he discovered that a previously unknown authentication flaw still let him reach shared network folders. Apple says Liu used that access while working for OpenAI to download dozens of confidential hardware files, including material about unreleased products, engineering specifications and project data.

Apple also alleges that Liu used a then-current employee's Apple device and advised that colleague about copying materials and preparing for an OpenAI interview. Separately, the complaint accuses OpenAI hardware chief Tang Tan of using Apple project code names in recruiting, asking candidates to bring hardware components to interviews, and circulating an internal Apple document about departure-security procedures.

Apple says it fixed the authentication flaw after discovering it. The complaint states that server logs showed a few other users could have been affected, but that those users did not appear to have accessed or taken confidential information. OpenAI said publicly that it has no interest in other companies' trade secrets and remains focused on building its own technology.

For security and data teams, the practical issue is not whether a termination ticket was marked complete. It is whether every path to sensitive systems was actually closed. That includes managed devices, identity-provider sessions, VPN and storage tokens, service credentials, shared-folder permissions, delegated access, and applications whose authorization state may outlive the central account.

LDS interpretation: high-risk departures should pair immediate access revocation with device recovery, session invalidation, a review of recent downloads, and short-term alerts for post-departure authentication or data movement. Logs should be preserved because they may be needed both for incident response and later legal review.

The complaint is Apple's account of the events. It does not establish that the defendants are liable, that every file Apple describes reached OpenAI, or that the alleged information shaped a product. Those questions would require evidence and court proceedings. The useful operational takeaway is narrower: offboarding controls should be tested against residual access, not assumed effective because a worker's status changed.