Sensitive patient data and proprietary information from materials science research were accessed in a manner indicative of preparation for data exfiltration. The activity was detected originating from an internal network, accessing multiple sensitive files in quick succession, and communicating to an external IP address known for malicious activities.