By Joyce M. Rosenberg

AP Business Writer

NEW YORK (AP) — After Suelyn Farel got an email alert that someone had downloaded her entire customer database, she learned that two former employees had conspired to steal from her beauty products company.

Farel had allowed the staffers to keep working after they each gave notice in late 2017; when they left the New York-based Julien Farel Group, their passwords for its system were still active. The theft led the company’s database provider to block Farel’s access for four months while the incident was being investigated, costing the firm an estimated $70,000 to $80,000 in business. Farel felt betrayed.

“It was a huge eye opener. I’m someone who’s very trusting and I love our employees,” she says. “It really reminded me that I have to be careful, that possibly my judgment of the character of people around me is wrong.”

Employees may steal from companies of any size, but small and mid-sized businesses can be more vulnerable because they lack practices and systems designed to prevent wrongdoing. Their technology may not be as secure as at a larger company, and they may not have the staffing to provide the kind of checks and balances that make it harder to steal. The more familiar atmosphere at some companies may make it easier for employees to plan and conceal a crime and keep on committing it.

Farel has since changed her policies. The day staffers give notice is usually their last and they lose their access to company email and the rest of the computer system. She keeps a list of everyone’s passwords and makes sure they are disabled.

Farel has taken steps that should be standard operating procedure at all companies, says Shira Forman, an employment attorney with Sheppard Mullin in New York. If a current staffer is suspected of stealing, bosses should still “cut off access and stop the bleeding,” Forman says.

“One approach might be to put the employee on leave while you investigate, and have any kind of data access frozen while you do that,” she says.

It’s a good idea, whether an owner suspects or knows for sure that a staffer has stolen, to get legal advice on how to proceed, Forman says.

In the case of a theft via computer, owners need an electronic paper trail. The initial email from Farel’s database provider said the download was made from an internet service provider in Brooklyn, so Farel knew the theft didn’t take place at her office. She was also able to find out that the download occurred at the new employer of one of the ex-staffers. Farel reported the theft to the district attorney’s office; the case has not yet been resolved.

There aren’t definitive statistics showing how many companies have experienced employee theft because many cases go unreported. Owners may feel embarrassment and shame, and don’t want to bring negative attention to their companies. But insurer Hiscox, which analyzed nearly 400 employee theft cases in federal courts in 2016, said 68 percent occurred at companies with fewer than 500 employees. Those companies lost a median $289,864.

Misplaced trust can be a problem for business owners who find it hard to imagine that a staffer, especially one who’s been with the company for years, would steal, says Doug Karpp, a senior vice president with Hiscox.