The Oregon outdoor-apparel company alleges in a lawsuit that its departing IT senior director created a dummy account on Columbia’s computer system and subsequently used it to access corporate emails and other internal Columbia documents hundreds of times.
Three years ago, Michael Leeper left his job at Columbia Sportswear for an executive role at Denali Advanced Integration, one of Columbia’s technology suppliers.
But he didn’t leave the Portland-area outdoor apparel company behind entirely, his former employer claims.
On his second-to-last day at Columbia, the company alleges in a lawsuit filed Wednesday in federal court in Portland, Leeper created a dummy account on Columbia’s computer system, and subsequently used it to access corporate emails and other internal Columbia documents hundreds of times.
The lawsuit names Redmond-based Denali, which also does business as 3MD, and Leeper, who still lives in Oregon.
Most Read Business Stories
In a statement, Denali didn’t address the substance of the lawsuit. The company said it was reviewing the complaint and would cooperate with any investigation. “These claims astonish us, and they in no way reflect Denali or its values,” said Chief Executive Majdi Daher. “We look forward to illuminating the facts, and to demonstrating Denali’s integrity.”
Leeper, who didn’t respond to an email seeking comment, will be placed on leave from the company, and will not have access to Denali employees, customers or partners, Denali said.
Denali is a technology reseller, packaging and selling software and hardware products from companies such as IBM, Cisco and EMC, along with support services, to corporate clients like Columbia.
Leeper was hired by Columbia in 2000 and held increasingly senior roles in the company’s information technology department. At the time of his departure from the company, he was senior director of technology infrastructure, the complaint says, overseeing Columbia’s systems worldwide.
In that capacity, he frequently dealt with Denali and other companies that sold technology products to Columbia, the complaint says.
In early 2014, Denali CEO Daher recruited Leeper to become Denali’s chief technology officer, the complaint says. Leeper gave notice at Columbia in February.
On March 2, 2014, Leeper’s penultimate day at Columbia, he created a network account under a false name, Jeff Manning, or jmanning, and gave that account wide permissions to access corporate email accounts, Columbia says. (Jeff Manning is also the name of an investigative reporter at The Oregonian newspaper in Portland.)
The account subsequently accessed Columbia’s network 700 times, the complaint says. Columbia detected the intrusions last summer while upgrading its email system, hired outside legal help and asked the FBI to aid in investigating the source of the breach.
In several instances last year, the account accessed email accounts for two Columbia IT employees who were responsible for buying the types of technology products that Denali sold, the complaint says. The account also accessed messages concerning budgets for upgrades to equipment Denali sells, the complaint says.
Denali and Leeper, Columbia’s complaint says, haven’t cooperated with the company’s efforts to find out what confidential business information was accessed, and what Denali might still hold.
Columbia has asked the court to order Denali and Leeper to destroy any information they obtained from their intrusion, and the company seeks an unspecified sum in damages.