An employee has been mining cryptocurrency for 5+ years. They installed mining software on most of our company PC's (approximately 40), and purchased items stating they were required by the company but in fact were for the mining rig. They used a work email to set up a cryptocurrency account.
How should we deal with this situation? Should this be a police matter?
Don't touch anything.
Document what you know, what you've done so far, and then talk to HR, your legal department or lawyers. They will probably advise you to suspend this employee (and their access) while they investigate.
Depending on the exact details and laws in your area, this almost certainly constitutes computer misuse and fraud, and possibly even theft depending on where those purchased items ended up.
This is a matter for lawyers and the police, not for you.
And once things have been sorted, have a serious look at your internal security and how the company is managed. Because if someone can install dodgy software on all your systems (that connects out to the Internet on unusual ports), use a huge amount of extra power, and fraudulently purchase a load of stuff with no one noticing for five years, that's pretty damning. And also raises the question of what else they might have done in that period that you don't know about..
I'd like to build on the previous answers submitted here.
You need to work IN CONCERT with your network administrators, HR, and law enforcement. The employee needs to be arrested, and SIMULTANEOUSLY, internet access for the mining rigs must be suspended. You don't know if the employee has accomplices, and you don't know if the rigs are remotely accessible from outside your company.
You want to SUSPEND the employee email account such that incoming email still comes in, but no one can log in to it. This might be accomplished by just a password change. But don't do this until you contact law enforcement. Be advised that if you're in the US, this might be a federal crime so you'd end up dealing with the FBI if it is.
And yes, have those attorneys ready. I wouldn't worry about recovering any financial gains, at least not immediately.
Until you make a concerted move, DO NOT suspend the employee or make the employee aware that you know what you know. Play dumb.
Congratulations, you've been robbed! Or more accurately, a victim of embezzlement.
This is a criminal matter. You may want to decide if you want a public record of having had this issue, which will happen if you report the crime and come after the perpetrator for the illicit gains. If you're a physical store, it will show you take security seriously. If you're a security consulting company, you might as well liquidate.
The best course of action to recover the stolen funds will have to be determined with a lawyer's assistance, one familiar with you local law and this kind of cases.
Crypto mining uses a lot of energy, it comprises over 50% of the coin's price. It's a way to turn energy into money. The coins mined with company equipment and power should legally be the property of the company. However, recovering crypto is difficult - it's been designed to prevent just that. A threat of criminal action is about the only way you can give the offender any incentive to give up the goods.
Once you start the criminal action, your leverage is reduced. Talk it out with a lawyer. They'll know what to do, considering your exact situation. There could be a significant amount to recover, if you can prove enough.
It might make sense to contact a private security company with pentest skills or a PI agency working in cyber. They will not necessarily be able to help, but it's possible that they could trace or get hold of some of the money that hasn't been deliberately hidden. As the owner of the hardware, you're allowed to "hack" it. If not, at least you'll get a second opinion.
TL;DR Taking the crypto was probably theft and breach of contract.
I would like to add something that the other answers haven't addressed. Check his employment contract - if he signed up for the account using a work email and was doing the mining using company computers, the crypto is company property under the terms of any sane employment agreement.
If the employee took the crypto for their own personal use, that constitutes theft (because the crypto was never theirs in the first place, which they presumably knew - or, at least, should have known - based on their employment contract). Also, failure to return the crypto to the company constitutes breach of contract.
I'm not really sure why you think there's anything to ask here - you fire them ASAP (assuming you have authority to do this and your evidence is undeniable).
You then discuss with your company's legal advisors (either in house if you have them, or talk to some external ones if you don't) as to what you can do in terms of legal action, both with regards to recovering any damages and whether a criminal offence has been committed.
You probably then also need to look at your internal controls, because the fact that an employee could do this for 5 years without anyone noticing implies a fairly big hole.
This is the time that you gather all parts of the management team together. There are legal issues, security issues, infrastructure issues, accounting issues. There may be multiple people involved, including those who approved the purchases. You may need to seek outside help.
Technically it all belongs to the company. It was either purchased with company funds, produced with company funds, or added to company equipment.
Destroying everything before the investigation can be completed might allow some of the guilty party to escape. There may even be criminal charges so the police might need to be involved.
These answers are WAY over the top.
Should the person in question be fired? Yes. Should the IT department do a full investigation and follow-up with a deep audit of what's installed on company computing infrastructure? Yes. Should a plan be developed by the IT department to prevent stuff like this from happening again? Yes. Should procurement practices be examined and audited carefully from now on? Yes.
Is this an "arrest-worthy" crime? Maybe in a mall-cop-turned-IT-pro's dream, but in real-life, NO!
This kind of thing happens a lot. It's an abuse of trust, certainly very sketchy, but it's more of an embarassment than a crime.
This question has really brought out the armchair lawyers!
In my view, the most straightforward way of dealing with this is as gross misconduct.
I don't necessarily agree with all the fuss about internal security in the other answers.
The most senior IT staff in a business are always in a position to configure the computers like so, and there is no oversight because they are the overseers.
There's absolutely nothing extraordinary about it, especially if a single person handles the entire IT function (quite plausible in a business with 40 PCs).
Just because a particular wily scheme has been discovered does not establish that there is wider irresponsibility or maliciousness against the employer.
The most likely justification they will have in their own minds is that they are using "spare" or idle processing capacity in the company equipment for mining. The question isn't clear about how much spend there was on additional equipment, or how the OP is clear that the equipment in question had no business purpose whatsoever.
I think the answers saying "don't touch anything" are laughable, as if a business is going to tolerate its entire IT estate being impounded, whilst they hire and apply a battery of lawyers and forensic computer experts.
In terms of seriousness, if the staff member responsible is a teenager or in their 20s, and probably not paid very well, I'd be inclined to think this is the kind of irresponsibility and nerdish cunning plan that could be expected. Having discovered the situation, it might be best just to tell them to unwind it all and give a written warning.
If you're dealing with someone much older who has the proper status of a manager in the business with serious responsibilities, it's perhaps a sacking offence.
The (many) justice warriors on this thread will be sad to find out that often in western jurisdictions mining crypto at work is mostly legal and will "merely" constitute grounds for a dismissal.
Basically you are going to have to make the decision about whether to fire or retain the employee. This comes down to a question of cost/benefit: Is the employee otherwise productive? Will the firing hurt morale in the organisation? Will it set a positive precedent? Is this an individual who the company is looking to get rid of for other reasons?
Personally I would look at the big picture and avoid making rash accusations of criminality that could end up backfiring.
