TL;DR
| Key Finding | Critical Data |
|---|---|
| 59% of companies suffered data breaches due to improper offboarding | Average loss: $4.99 million |
| 47% of former employees still had system access after leaving | 56% admitted logging in post-departure |
| 32% of companies took over a week to fully revoke ex-employee permissions | OAuth tokens are the biggest blind spot |
| Safe personal backup method | Thunderbird + ImportExportTools NG export to EML format |
A Forgotten Forwarding Rule Let Company Secrets Leak for Months
Three months after the marketing director left, the company discovered a forwarding rule he set on his first day was still running—all client quotes and competitive analyses sent to his old inbox were continuously auto-forwarded to his personal Gmail.
This isn’t an isolated case. CheckFlow’s 2026 security report reveals: 59% of companies suffered data breaches due to improper offboarding, 47% of former employees could still access company apps after leaving, and 56% of those admitted logging in post-departure. Even more shocking, 71% of businesses have no formal offboarding process.
Offboarding email handover sounds like an HR and IT issue. But in reality, it’s something every professional will face sooner or later—either you’re taking over a departing colleague’s workload, or you’re the one leaving.
5 Classic Offboarding Email Handover Trainwrecks
Scenario 1: Broken business contacts—A sales director leaves and takes client relationships with them. The replacement has no clue about past email threads or quote records, causing three major accounts to go cold. Beyond data loss, rebuilding client trust costs even more.
Scenario 2: Premature account deletion—The moment the employee finishes paperwork, IT deletes the email account. But contract approvals and payment confirmations attached to past emails are all gone. Most email trash bins only keep data for 30 days.
Scenario 3: Personal email forwarding violates compliance—An employee forwards work emails to their personal QQ inbox after leaving, and the company loses all control. If client personal data is involved, it also violates data protection laws.
Scenario 4: Residual OAuth tokens—The account appears disabled, but third-party app tokens for CRM, cloud drives, and Slack that the ex-employee connected are still valid. Disabling the account only blocks login, not authorized API calls.
Scenario 5: Local data left uncleaned—Outlook PST files and Thunderbird local databases on the employee’s computer contain all work emails, and no one follows up after they leave.
Company Side: 7-Step Offboarding Email Handover SOP
Day 1 (Departure Date):
- Immediately disable the account—Don’t delete it! Disabling allows quick restoration. Deletion gives you only a 30-day window in the trash.
- Revoke client-side security passwords—Force immediate logout and deactivation on the employee’s phone and computer email clients.
- Set up an auto-reply—Inform senders that the employee has left and provide the replacement’s contact info.
- Set up auto-forwarding—Forward new emails to the replacement (note: keep the original account as an anchor).
Day 2 (24 Hours After Departure):
- Clean up OAuth tokens—Go into Google Admin / M365 Azure AD and revoke all third-party app authorizations. This step is often overlooked but is critical to preventing ongoing data leaks.
- Transfer file ownership—Move cloud drive file ownership to the replacement.
Day 7 (One Week After Departure):
- Archive or convert to shared mailbox—Depending on business needs, convert the mailbox to a shared mailbox or export an archive.
Personal Side: How to Safely Back Up Work Emails Before Leaving
If you’re the one leaving and want to take a backup of your work emails, never use personal email forwarding—it’s both insecure and against policy. The right way:
- Configure your company email in Thunderbird (IMAP protocol): Download Thunderbird, add your work email, and choose IMAP over POP3. POP3 removes emails from the server.
- Sync all emails: Set all folders to be available offline in Thunderbird, and wait for the full download to complete.
- Install the ImportExportTools NG add-on: Search for and install it from Thunderbird’s extension store.
- Export to EML format: Right-click the Inbox or Sent folder, select “Export all messages → EML format.” Each email becomes a separate .eml file, preserving sender, timestamp, attachments, and headers.
- Verify and archive: Open a few .eml files with a text editor or email client to confirm integrity, then archive them by year and month.
Why not forwarding? EML is a standard email format that can be permanently stored, full-text searched, and imported into any email client at any time. Forwarding loses critical header information and violates corporate data security policies.
3 Most Overlooked Stealth Leak Channels
Channel 1: Auto-forwarding rules—An employee set up a forwarding rule ages ago and forgot about it. It keeps running after they leave, and the company has no idea. Prevention: Add a step in the offboarding process to check for email forwarding rules.
Channel 2: Mobile device ActiveSync—Once a company email is configured on an employee’s phone, even if the password is changed, the ActiveSync authorization may still be valid. Prevention: Actively wipe the employee’s mobile device email data from the admin console.
Channel 3: Third-party app OAuth—An employee logged into a project management tool with their Google account, and that tool read their inbox. The company disabled the account, but the project management tool can still read new emails. Prevention: 24 hours after disabling the account, run a second round of OAuth token cleanup.
Conclusion: Offboarding Email Handover Isn’t IT’s Problem—It’s Everyone’s Problem
The biggest issue with offboarding email handover isn’t technical—it’s awareness. Most people think, “It’s just an email account.” But data shows 59% of companies have been burned by this, with an average loss of $4.99 million.
For companies: Establishing a formal offboarding process isn’t optional—it’s mandatory. 71% of companies don’t have one, which means your competitors might already have one in place.
For individuals: Don’t use forwarding to back up emails before you leave. Use Thunderbird + EML export—it’s safe, compliant, and you can restore everything into any email client later.
After all, an email might not just be an email—it could be a contract, a promise, or a deal.
