memo-data-exfiltration-findings.docx

1038-00006 · Calderwood & Harkness LLP · Investigation & Analysis

memo-data-exfiltration-findings.docx DOCUMENT Finance & Banking

46 / 79 ← → ✕

PRIVILEGED AND CONFIDENTIAL – ATTORNEY WORK PRODUCT Prepared at the direction of counsel in anticipation of litigation. Do not forward or distribute without authorization.

CALDERWOOD & HARKNESS LLP 1301 K Street NW, Suite 1200 Washington, DC 20005

Matter No.: 1038-00006 Date: March 1, 2025

TO: Bernard Crawford, Responsible Partner, Labor & Employment

FROM: Devon Archer, Working Associate, Labor & Employment

RE: Summary of Pinnacle Forensics LLC Preliminary Findings – Data Exfiltration by Rathore Group from Cascade Retail Holdings Inc. Systems

PRIVILEGED AND CONFIDENTIAL – ATTORNEY WORK PRODUCT. This memorandum has been prepared at the direction of counsel in anticipation of litigation. It is protected by the attorney-client privilege and the attorney work product doctrine. Do not forward or distribute without authorization from the Responsible Partner.

I. Executive Summary

The purpose of this memorandum is to summarize the preliminary forensic findings of Pinnacle Forensics LLC ("Pinnacle"), as communicated to Calderwood & Harkness LLP ("C&H") in Pinnacle's preliminary report delivered on February 28, 2025 (the "Preliminary Report"). The Pinnacle engagement is led by Dr. Rajiv Anand, a certified digital forensics examiner with over twenty years of experience in corporate data theft investigations. This memorandum is intended to provide a comprehensive overview of Pinnacle's findings to date for the purpose of informing litigation strategy and supporting potential court filings on behalf of our client, Cascade Retail Holdings Inc. ("CRH"), in the pending action filed in the Delaware Court of Chancery, C.A. No. 2025-0198-MTZ.

Pinnacle was retained by C&H on February 20, 2025, on behalf of CRH, to conduct forensic imaging of all CRH-issued computing devices returned by eight departing employees and to analyze CRH cloud environment access logs and data exfiltration patterns. The engagement followed CRH's discovery that a group of eight senior merchandising employees — led by Priya Rathore, CRH's former Senior Vice President of Merchandising — had resigned simultaneously on February 7, 2025, and joined Verdana Commerce Group, Inc. ("Verdana" or "VCG"), a direct competitor headquartered in Wilmington, Delaware.

The headline finding of the Pinnacle Preliminary Report is as follows: a total of 14,327 files comprising approximately 2.8 gigabytes of data were downloaded from CRH's Sundial Systems and Pinnacle Health IT environments to personal cloud storage accounts between January 10, 2025 and February 4, 2025. The exfiltrated files include materials that are among the most competitively sensitive in CRH's possession, including Project Ridgeline strategic presentations, vendor negotiation term sheets, private-label cost models, customer segmentation data, and seasonal buying algorithms. These materials collectively represent the core intellectual capital of CRH's merchandising division, which accounted for $2.3 billion in gross merchandise value in fiscal year 2024.

The exfiltration activity was conducted by multiple members of the departing merchandising team (referred to herein as the "Rathore Group") in a pattern that appears to be coordinated in both timing and methodology. Each departing employee systematically downloaded files within their specific functional area of responsibility, and the exfiltration activity commenced just four days after a recruitment dinner meeting between Rathore and senior leaders of Verdana and its primary financial backer, Greystone Capital Partners. The temporal alignment between the recruitment timeline and the data exfiltration timeline strongly supports the inference that the data theft was planned and executed in connection with the Rathore Group's coordinated departure to Verdana.

This memorandum is prepared to support litigation strategy and potential court filings in the Delaware Court of Chancery, C.A. No. 2025-0198-MTZ, including CRH's anticipated motion for a temporary restraining order and preliminary injunction.

II. Background

A. The Departing Employees

On February 7, 2025, at 4:47 PM PST, eight senior employees of CRH's merchandising division submitted simultaneous resignation letters via email, each stating that the resignation was effective immediately. The simultaneous timing of the resignations — all eight emails were sent within a sixty-second window — itself suggests a high degree of coordination among the departing employees.

The departures were led by Priya Rathore, CRH's former Senior Vice President of Merchandising. Rathore was employed by CRH from June 3, 2019 through February 7, 2025, a tenure of approximately five years and eight months. Rathore was a member of CRH's senior leadership team and reported directly to CRH's Chief Operating Officer, Michael Houghton. During her tenure, Rathore had access to virtually all strategic, financial, and operational information relating to CRH's merchandising division. She was the executive sponsor of Project Ridgeline, CRH's five-year strategic category expansion plan, and was intimately involved in its development from inception through its completion in October 2024.

Rathore signed an Amended and Restated Employment Agreement on March 15, 2021 (the "Rathore Agreement"), which contains robust restrictive covenant provisions, including an eighteen-month post-termination non-competition covenant, a twenty-four-month post-termination non-solicitation covenant (covering both employees and business relationships), and a perpetual confidentiality obligation covering all proprietary and confidential information of CRH. The Rathore Agreement is governed by Delaware law and contains a forum selection clause designating the Delaware Court of Chancery as the exclusive forum for disputes arising under the agreement.

The seven other departing employees, together with Rathore collectively constituting the "Rathore Group," are as follows:

1. Derek Linden — Vice President, Hardlines Merchandising. Employed by CRH for approximately seven years. Linden oversaw CRH's hardlines merchandising strategy, including vendor relationships, pricing, and competitive positioning across hardware, outdoor, and home improvement categories.

2. Sonia Kaczmarek — Vice President, Softlines Merchandising. Employed by CRH for approximately five years. Kaczmarek managed CRH's softlines merchandising portfolio, including seasonal apparel, home textiles, and related soft goods categories.

3. Amara Osei — Director, Private Label Strategy. Employed by CRH for approximately four years. Osei was responsible for CRH's private-label brand portfolio, including sourcing strategies, manufacturer relationships, cost modeling, and margin architecture for CRH's proprietary brands.

4. Brent Halvorsen — Director, Seasonal Planning & Analytics. Employed by CRH for approximately six years. Halvorsen led CRH's seasonal buying cycle planning, demand forecasting, and inventory optimization functions, utilizing proprietary analytical models and algorithms developed during his tenure.

5. Lucia Fernandez-Gill — Director, Vendor Relations (Domestic). Employed by CRH for approximately five years. Fernandez-Gill managed CRH's domestic vendor relationship portfolio, including vendor negotiations, term sheets, rebate programs, and exclusivity arrangements.

6. Nathan Tsao — Senior Manager, eCommerce Merchandising. Employed by CRH for approximately three years. Tsao was responsible for CRH's ecommerce assortment strategy, pricing optimization algorithms, and online merchandising playbooks for CRH's direct-to-consumer digital platform.

7. Kira Johansson — Senior Manager, Category Analytics. Employed by CRH for approximately four years. Johansson led CRH's category analytics function, producing customer segmentation models, purchase pattern analyses, market share assessments, and lifetime value calculations that informed CRH's merchandising and marketing strategies.

All eight departing employees left CRH to join Verdana Commerce Group, Inc. Verdana is a direct competitor of CRH in the retail sector, headquartered in Wilmington, Delaware. Verdana publicly announced the hiring of all eight former CRH employees in a press release issued on February 14, 2025, one week after the coordinated resignations. The press release described the hires as part of Verdana's "transformational growth initiative" and specifically highlighted the team's expertise in merchandising strategy, private-label development, and data-driven category management — all areas that directly correspond to CRH's core competitive strengths.

Each of the seven other departing employees, like Rathore, executed employment agreements with CRH that contain confidentiality obligations and restrictive covenant provisions. All such agreements are governed by Delaware law. The specific terms of each employee's restrictive covenants vary in duration, but all include post-termination non-competition periods of at least twelve months, non-solicitation periods of at least eighteen months, and perpetual confidentiality obligations.

B. CRH's discovery of Potential Data Theft

On February 10, 2025, three days after the simultaneous resignations, CRH's Chief People Officer, Roland Ashby, formally alerted CRH's General Counsel, Theresa Yun-Park, to the coordinated nature of the departures and the potential risk of data theft and competitive harm. Ashby noted that the simultaneous resignations of eight senior employees to a single direct competitor were unprecedented in CRH's corporate history and suggested the departures were the result of a deliberate and coordinated recruitment effort by Verdana.

On February 12, 2025, CRH's in-house legal team completed its initial review and confirmed the restrictive covenant provisions contained in each departing employee's employment agreement. On the same date, CRH's Information Technology department, at the direction of Yun-Park, conducted a preliminary review of system access logs and identified anomalous data access and download activity in the weeks preceding the resignations. Specifically, CRH's IT department observed a marked increase in file download volumes from CRH's Aldermere Systems and Pinnacle Health IT environments during the January 10 through February 4, 2025 period, with download volumes for several of the departing employees' accounts exceeding their historical averages by a factor of ten or more. These initial findings prompted CRH to seek outside counsel and forensic expertise immediately.

CRH retained Calderwood & Harkness LLP on February 18, 2025, and the firm opened this matter under number 1038-00006 on the same date. Following an initial assessment by the C&H team and a discussion with CRH's General Counsel, C&H engaged Pinnacle Forensics LLC on February 20, 2025 to conduct a comprehensive forensic investigation of the suspected data exfiltration.

C. Scope of Pinnacle Engagement

The Pinnacle engagement, as defined in the February 20, 2025 engagement letter, encompasses the following work streams:

1. Device Forensic Imaging. Forensic imaging of all CRH-issued laptops and mobile devices returned by the eight departing employees following their February 7, 2025 resignations. Pinnacle received custody of these devices on February 21, 2025, and completed forensic imaging by February 24, 2025, following chain-of-custody protocols consistent with Federal Rules of Evidence standards.

2. Cloud Environment Access Log Analysis. Analysis of CRH cloud environment access logs for Sundial Systems (CRH's corporate document management system) and Pinnacle Health IT (CRH's vendor relationship management and customer data platform) for the period of October 1, 2024 through February 7, 2025. The analysis window extends back to October 1, 2024 to establish baseline access patterns for each departing employee and to identify any anomalous activity that predates the January 10, 2025 start date of the concentrated exfiltration window.

3. File Download and Transfer Cataloguing. Identification and cataloguing of all files downloaded, transferred, or accessed in an unusual pattern during the analysis period, with particular attention to bulk downloads, downloads to non-CRH destinations, and downloads outside of normal business hours.

4. USB Device and External Storage Analysis. Analysis of USB device connections and external storage device usage on all CRH-issued devices, including identification of connected device types, connection timestamps, and associated file transfer activity.

5. Email Metadata Review. Review of email metadata and outbound communications from CRH email accounts (Microsoft) for the final thirty days of each departing employee's employment, with a focus on identifying any transmission of confidential files or information to external addresses.

Pinnacle delivered its Preliminary Report to Calderwood & Harkness on February 28, 2025. The Preliminary Report addresses all five work streams described above and presents findings based on the data analyzed to date. Pinnacle has indicated that a final supplemental report is expected by approximately March 10, 2025, which will include additional analysis as described in Section VIII below.

III. Summary of Forensic Findings

A. Overall Data Exfiltration Volume

Pinnacle's Preliminary Report identifies a total of 14,327 files exfiltrated from CRH systems during the period of January 10, 2025 through February 4, 2025. The total data volume of the exfiltrated files is approximately 2.8 gigabytes. While the data volume in gigabytes may appear modest in absolute terms, the nature and sensitivity of the files — which consist primarily of document files, spreadsheets, presentations, and structured data exports rather than large media files — render the volume highly significant from a competitive intelligence standpoint. As Dr. Anand noted in the Preliminary Report, the exfiltrated file set constitutes a "comprehensive operational and strategic intelligence package" for CRH's merchandising division.

The source systems from which the files were exfiltrated are CRH's Sundial Systems environment, which serves as CRH's primary corporate document management system for the merchandising division, and CRH's Pinnacle Health IT environment, which serves as CRH's vendor relationship management platform and contains customer data, vendor contact information, and relationship management records.

The destination of the exfiltrated files was personal cloud storage accounts not associated with CRH's corporate infrastructure. The primary destinations were personal Hollowell Health IT accounts and personal Larkspur Technologies accounts maintained by the departing employees. These personal cloud storage services are not authorized for use in connection with CRH business, and CRH's Information Security Policy (revised January 2024) expressly prohibits the transfer of confidential business information to personal cloud storage accounts.

The exfiltration window spans twenty-six calendar days, from January 10, 2025 through February 4, 2025. The start date of January 10, 2025 is particularly noteworthy because it falls just four days after the January 6, 2025 dinner meeting between Verdana CEO Warren Dietrich, Greystone Capital Partners Managing Partner Elliot Westbrook, and Priya Rathore at a restaurant in New York City. That dinner meeting, which has been identified and documented by Aurelian Investigations Group Inc. (discussed further in Section VI below), appears to represent the initiating event in the Rathore Group's coordinated departure and, based on the temporal proximity, the catalyst for the data exfiltration campaign that began four days later.

B. Exfiltration by Individual Employee

Pinnacle's Preliminary Report provides a detailed breakdown of the files attributed to each departing employee's CRH user credentials. The following summarizes the key findings for each individual:

Priya Rathore — Rathore accounts for the largest volume of downloads among the eight departing employees. Rathore accessed and downloaded files across all data categories identified by Pinnacle, reflecting her senior leadership role and her broad access permissions within CRH's systems. Her downloads include the complete Project Ridgeline file set (all 847 files), executive-level vendor negotiation term sheets that were restricted to VP-level and above access, and the five-year category expansion roadmap presentations that she had helped develop in her capacity as executive sponsor of Project Ridgeline. Rathore's download activity was concentrated in two primary clusters: January 10–15, 2025, when she accessed and downloaded high-level strategic documents; and January 27–February 3, 2025, when she conducted a second, broader sweep of files that included operational documents and additional vendor data. The January 27 date is significant because it is the date on which Rathore signed her offer letter with Verdana, suggesting that she undertook a final comprehensive collection of CRH materials upon formal acceptance of the competing position.

Derek Linden — Linden's downloads were focused on hardlines merchandising data, consistent with his functional area of responsibility as VP of Hardlines Merchandising. The downloaded files include vendor pricing schedules for CRH's top fifty hardlines vendors, competitive positioning analyses comparing CRH's hardlines assortment and pricing against key competitors (including Verdana), and category-specific margin analyses for hardware, outdoor, and home improvement product lines. Linden's download activity was concentrated in the January 22–30, 2025 period.

Sonia Kaczmarek — Kaczmarek's downloads were focused on softlines merchandising data, including seasonal buy plans covering the Spring/Summer 2025 and Fall/Winter 2025 buying cycles, margin analysis workbooks for CRH's softlines categories, and vendor allocation models. The seasonal buy plans in particular represent time-sensitive, forward-looking competitive intelligence that could provide Verdana with immediate insight into CRH's upcoming merchandising strategies. Kaczmarek's download activity was concentrated in the January 20–28, 2025 period.

Amara Osei — Osei downloaded the entirety of the private-label sourcing strategy file repository maintained on CRH's Aldermere Systems environment. This repository includes private-label cost models for all of CRH's proprietary brands, manufacturer agreements and correspondence, quality scorecards for private-label suppliers, and margin target documents setting forth CRH's profitability objectives for its private-label portfolio. Osei's downloads represent a complete extraction of CRH's private-label intellectual property and sourcing infrastructure. Osei's download activity was concentrated in the January 22 – February 2, 2025 period.

Brent Halvorsen — Halvorsen downloaded seasonal planning algorithms, demand forecasting models, and historical analytics dashboards from CRH's Aldermere Systems environment. These materials include proprietary algorithmic models developed by CRH's analytics team over several years and refined by Halvorsen during his six-year tenure. The demand forecasting models, in particular, represent significant intellectual investment by CRH and are central to CRH's inventory optimization and seasonal planning capabilities. Halvorsen's download activity was concentrated in the January 24 – February 3, 2025 period. Additionally, USB device connection logs on Halvorsen's CRH-issued laptop indicate that an external storage device was connected and used for file transfer on January 31, 2025 and February 2, 2025.

Lucia Fernandez-Gill — Fernandez-Gill downloaded domestic vendor contact databases, vendor negotiation term sheets for CRH's top one hundred domestic vendor relationships, and relationship management notes maintained in CRH's Pinnacle Health IT environment. The vendor contact databases include proprietary contact information for key decision-makers at each vendor, negotiation history, and relationship notes that are not publicly available. The term sheets include CRH's negotiated pricing, volume discount thresholds, exclusivity arrangements, and rebate schedules — all of which represent confidential commercial terms that could be exploited by a competitor in head-to-head vendor negotiations. Fernandez-Gill's download activity was concentrated in the January 25 – February 4, 2025 period.

Nathan Tsao — Tsao downloaded ecommerce merchandising playbooks, pricing optimization algorithms, and online assortment strategy documents from CRH's Aldermere Systems environment. The pricing optimization algorithms are proprietary models developed by CRH's ecommerce team to manage dynamic pricing across CRH's direct-to-consumer platform, and the assortment strategy documents detail CRH's category-level plans for online product selection and curation. Tsao's download activity was concentrated in the January 26 – February 3, 2025 period. USB device connection logs on Tsao's CRH-issued laptop indicate that an external storage device was connected on February 1, 2025.

Kira Johansson — Johansson downloaded category analytics reports, customer segmentation data, and market-share analysis models from both CRH's Aldermere Systems and Pinnacle Health IT environments. The customer segmentation data includes proprietary models classifying CRH's customer base by demographics, purchase behavior, engagement frequency, and estimated lifetime value — data that represents years of investment in analytics infrastructure and data science capabilities. Johansson's download activity was concentrated in the January 24 – February 4, 2025 period. USB device connection logs on Johansson's CRH-issued laptop indicate that an external storage device was connected on January 30, 2025 and February 3, 2025.

Pattern Observation: As Dr. Anand observes in the Preliminary Report, each employee appears to have focused their downloads on materials directly within their functional area of responsibility. This pattern is inconsistent with incidental or casual access and strongly suggests systematic, deliberate, and purposeful collection of CRH trade secrets and confidential information. The functional specificity of each employee's downloads implies that the Rathore Group members were each assigned — or independently undertook — the task of extracting the materials most relevant to their particular expertise, resulting in a collectively comprehensive exfiltration of CRH's merchandising division's intellectual capital.

C. Exfiltration Timeline and Methodology

Pinnacle's Preliminary Report identifies three distinct phases of the data exfiltration activity, each corresponding to key events in the recruitment and departure timeline:

Phase 1 — January 10–15, 2025 (Initial Strategic Document Collection). The first phase of exfiltration activity is attributable primarily to Priya Rathore and involves the download of high-level strategic documents, most notably the Project Ridgeline master presentations and related strategic planning materials. This phase coincides with the period immediately following the January 6, 2025 dinner meeting between Rathore, Verdana CEO Warren Dietrich, and Greystone Capital Partners Managing Partner Elliot Westbrook. The Phase 1 activity also overlaps with the encrypted messaging exchanges among the Rathore Group that took place during the January 13–24, 2025 period (as identified by Aurelian Investigations Group). The nature of the Phase 1 downloads — focused on the most senior-level strategic materials — suggests that Rathore was collecting CRH's highest-value strategic intelligence in the immediate aftermath of the recruitment overture.

Phase 2 — January 20–28, 2025 (Broadening Across Team Members). The second phase marks the expansion of exfiltration activity beyond Rathore to multiple members of the departing team. During this period, Linden, Kaczmarek, Osei, Halvorsen, Fernandez-Gill, Tsao, and Johansson each begin significant download activity from CRH systems. The downloads during Phase 2 expand beyond strategic documents to include operational data sets, vendor term sheets, cost models, and analytical tools. Notably, Rathore signed her Verdana offer letter on January 27, 2025, during Phase 2, and the broadening of exfiltration activity across the full team suggests that the other Rathore Group members were progressively recruited and began their own data collection efforts as the departure plan solidified.

Phase 3 — January 28 – February 4, 2025 (Highest Volume; Final Collection). The third and final phase represents the period of highest download volume. During this phase, all remaining seven employees signed their Verdana offer letters (between January 28 and February 4, 2025), and the final data pulls included customer segmentation files, category analytics reports, and other materials that completed the comprehensive extraction of CRH's merchandising division data. The exfiltration activity ceased on February 4, 2025, three days before the simultaneous resignations on February 7, 2025. The cessation of activity on February 4 suggests that the Rathore Group considered their data collection to be complete by that date and shifted their focus to the logistics of the coordinated departure.

Methodology Observed. Pinnacle's analysis of the exfiltration methodology reveals a consistent pattern across all eight departing employees. The employees accessed CRH's Aldermere Systems and Pinnacle Health IT environments using their valid CRH-issued credentials from CRH-issued devices during the normal course of their employment. Files were downloaded from the cloud environments to local storage on the CRH-issued laptops. The files were then transferred from local storage to personal cloud storage accounts — primarily personal Hollowell Health IT and personal Larkspur Technologies accounts — that are not associated with CRH's corporate infrastructure and are not authorized for use with CRH data under CRH's Information Security Policy.

Several employees used browser-based upload interfaces to transfer files to their personal Hollowell Health IT accounts, which left clear and readily identifiable access log trails in both the CRH cloud environment logs and the browser histories on the CRH-issued devices. Others used desktop client applications for cloud storage services that had been installed on CRH-issued devices. Specifically, Rathore's CRH-issued laptop had the Hollowell Health IT desktop client application installed, and Osei's and Fernandez-Gill's CRH-issued laptops had the Larkspur Technologies desktop client application installed. The installation of personal cloud storage client applications on CRH-issued devices is a violation of CRH's Acceptable Use Policy.

In addition to cloud-based transfer, USB device connections were detected on three of the eight CRH-issued devices — those belonging to Halvorsen, Tsao, and Johansson — suggesting that these individuals also exfiltrated data via external storage media such as USB flash drives or external hard drives. The specific external storage devices have not been recovered or imaged, as they were not returned to CRH with the CRH-issued devices.

Pinnacle notes that there is no evidence that the departing employees attempted to delete system access logs, use anonymizing tools or VPN services to obscure their activity, or employ any other sophisticated obfuscation techniques. Dr. Anand characterizes the exfiltration as "brazen" in that it was conducted using normal CRH credentials, standard download processes, and readily traceable transfer methods. The absence of obfuscation efforts may reflect a belief on the part of the departing employees that their activity would not be detected before their departure, or it may simply reflect a lack of concern about detection — either interpretation underscores the deliberate nature of the data theft.

IV. Categories of Exfiltrated Data

Pinnacle's Preliminary Report classifies the 14,327 exfiltrated files into six principal categories based on subject matter. The following provides a detailed summary of each category, the approximate number of files involved, and the significance of the materials from CRH's competitive standpoint.

A. Project Ridgeline Materials

A total of 847 files are directly associated with "Project Ridgeline," CRH's five-year strategic category expansion plan. Project Ridgeline was developed over the course of approximately fourteen months, from August 2023 through October 2024, under the executive sponsorship of Priya Rathore and with significant contributions from the broader merchandising leadership team. It represents CRH's most comprehensive and forward-looking strategic planning effort, encompassing category-by-category analysis, financial projections, competitive positioning, and execution roadmaps.

The exfiltrated Project Ridgeline materials include the following subcategories of documents:

• Master strategy decks presented to CRH's Board of Directors in October 2024, containing the complete five-year strategic vision for CRH's merchandising division;

• Detailed financial projections, including revenue, margin, and profitability targets by category and by year for the 2025–2029 planning period;

• Category-by-category expansion timelines identifying target categories for growth, planned entry dates, investment requirements, and competitive benchmarking;

• Private-label margin targets establishing CRH's profitability objectives for its proprietary brand portfolio within each expansion category;

• eCommerce assortment algorithm specifications detailing the technical parameters and business logic underlying CRH's online merchandising optimization systems; and

• Vendor negotiation frameworks establishing CRH's strategic approach to vendor terms, including target pricing, volume commitments, exclusivity objectives, and co-marketing arrangements for the expansion categories.

The Rathore Group had full access to Project Ridgeline materials during their employment, as all eight employees were active contributors to or stakeholders in the project. These materials represent CRH's most competitively sensitive forward-looking strategic plans. CRH's merchandising division accounted for $2.3 billion in gross merchandise value in fiscal year 2024, and Project Ridgeline is designed to drive growth in the highest-value and highest-margin segments of CRH's business. The disclosure of Project Ridgeline materials to a direct competitor would provide that competitor with a detailed roadmap of CRH's strategic intentions, enabling preemptive competitive responses and fundamentally undermining the plan's viability.

B. Vendor Negotiation Term Sheets

Approximately 3,200 files relate to CRH's vendor negotiation playbooks and specific term sheets for active vendor agreements. This category includes the following types of materials:

• Proprietary negotiation strategies setting forth CRH's approach to vendor negotiations, including walk-away positions, concession sequences, and leverage points;

• Volume discount thresholds and tiered pricing structures negotiated with CRH's top vendors;

• Exclusivity arrangements granting CRH preferential or exclusive access to certain products, brands, or geographic territories;

• Rebate schedules and performance-based incentive structures negotiated with domestic and international vendors; and

• Vendor-specific negotiation histories and relationship notes maintained in CRH's Pinnacle Health IT environment.

The sensitivity of this category is particularly acute given the competitive dynamics between CRH and Verdana. The two companies directly compete in twenty-eight overlapping product categories, and many of CRH's vendor relationships involve the same manufacturers and distributors with which Verdana also transacts. Armed with CRH's vendor negotiation term sheets, Verdana would possess detailed knowledge of CRH's pricing, discount structures, and negotiation strategies, enabling Verdana to undercut CRH's vendor terms or to poach vendor relationships by offering marginally more favorable conditions. Verdana has publicly announced a "transformational growth initiative" targeting expansion into CRH's strongest categories, making the vendor negotiation data immediately actionable for Verdana's competitive purposes.

C. Private-Label Cost Models

Approximately 2,100 files relate to CRH's private-label sourcing strategies. CRH's private-label brand portfolio is one of the company's most significant competitive differentiators, and the materials exfiltrated in this category represent the proprietary intelligence underlying that advantage. The exfiltrated materials include:

• Manufacturer cost structures detailing CRH's negotiated unit costs for private-label products, including raw material costs, manufacturing costs, and packaging costs;

• Landed cost models incorporating shipping, customs duties, warehousing, and logistics costs for both domestic and international sourcing;

• Target margin architectures establishing CRH's profitability objectives for each private-label brand and product category;

• Supplier quality scorecards rating private-label manufacturers on quality, reliability, capacity, and compliance criteria; and

• Manufacturer agreements, including key commercial terms, volume commitments, and quality specifications.

CRH's private-label home goods and seasonal décor lines are identified in Project Ridgeline as CRH's strongest categories and highest-margin product lines. These are precisely the categories that Verdana has publicly targeted for expansion in its February 14, 2025 press release. With access to CRH's private-label cost models, Verdana would be able to replicate CRH's sourcing strategies, approach CRH's manufacturers with competitive offers, and develop competing private-label programs that directly undermine CRH's category advantage.

D. Customer Segmentation Data

Approximately 1,850 files contain CRH customer analytics data, representing a significant portion of CRH's data science and marketing intelligence infrastructure. The exfiltrated materials include:

• Customer segmentation models classifying CRH's customer base into behavioral and demographic segments;

• Purchase pattern analyses identifying purchasing frequency, basket composition, channel preferences, and seasonal buying tendencies across customer segments;

• Demographic profiling data linking customer segments to geographic, income, age, and lifestyle characteristics; and

• Lifetime value calculations estimating the long-term revenue and profitability contribution of each customer segment.

This data was downloaded primarily from CRH's Pinnacle Health IT environment and represents years of investment in analytics infrastructure, data collection, and data science capabilities. The customer segmentation data underpins CRH's ecommerce personalization strategies and targeted marketing campaigns across its 387 brick-and-mortar retail locations and its direct-to-consumer ecommerce platform. Access to this data would enable Verdana to target CRH's most valuable customer segments with precision and to develop competing marketing strategies calibrated to the specific behavioral and demographic characteristics of CRH's customer base.

E. Seasonal Buying Algorithms and Planning Data

Approximately 2,400 files relate to CRH's seasonal buying cycles, demand forecasting capabilities, and inventory management systems. The exfiltrated materials include:

• Seasonal buying algorithms governing CRH's purchasing decisions for seasonal product categories, including holiday, spring/summer, and back-to-school merchandise;

• Demand forecasting models incorporating historical sales data, macroeconomic indicators, weather patterns, and trend analysis to predict future demand at the category, product, and store level;

• Inventory optimization models designed to minimize carrying costs while maintaining target in-stock rates; and

• Historical purchasing data spanning multiple years of buying activity, providing the training data for CRH's algorithmic forecasting systems.

These materials were downloaded primarily by Halvorsen and Johansson, consistent with their respective functional responsibilities in seasonal planning and category analytics. The demand forecasting and inventory optimization models represent proprietary analytical tools that CRH has developed and refined over several years, and they constitute a core component of CRH's operational competitive advantage.

F. Other Confidential Business Information

The remaining approximately 3,930 files include miscellaneous operational documents that, while individually less sensitive than the foregoing categories, collectively provide a comprehensive operational picture of CRH's merchandising division. These files include:

• Internal meeting notes from merchandising leadership team meetings, strategy sessions, and vendor review meetings;

• Competitive intelligence reports analyzing the strategies, assortments, and pricing of CRH's key competitors (including Verdana);

• Personnel performance reviews for members of CRH's merchandising team, including talent assessments, succession planning documents, and compensation data; and

• Organizational planning documents, including headcount projections, budget allocations, and divisional restructuring plans.

While any one of these documents in isolation might be of limited competitive value, the aggregate collection provides Verdana with a detailed and multifaceted view of CRH's internal operations, organizational capabilities, talent pipeline, and competitive intelligence efforts. In combination with the higher-sensitivity categories described above, these materials complete a comprehensive intelligence dossier on CRH's merchandising division.

V. CRH Device Analysis

Following the February 7, 2025 resignations, CRH collected all CRH-issued laptops and mobile devices from the eight departing employees through CRH's standard offboarding process. The devices were secured by CRH's IT department and transferred to Pinnacle Forensics on February 21, 2025 pursuant to chain-of-custody protocols. Pinnacle completed forensic imaging of all devices by February 24, 2025, creating bit-for-bit forensic copies of each device's storage media for analysis while preserving the original devices in their received condition.

The key findings from Pinnacle's device analysis are as follows:

Personal Cloud Storage Application Installation. Several of the CRH-issued devices showed evidence of personal cloud storage application installation. Specifically, Rathore's CRH-issued laptop had the Hollowell Health IT desktop client application installed, and the laptops of Osei and Fernandez-Gill had the Larkspur Technologies desktop client application installed. The installation of personal cloud storage client applications on CRH-issued devices is prohibited under CRH's Acceptable Use Policy (Section 4.3, "Prohibited Software Installations"), which expressly restricts CRH-issued devices to software approved and provisioned by CRH's IT department. The presence of these applications facilitated the seamless transfer of downloaded CRH files to personal cloud accounts and provides additional evidence of the deliberate nature of the exfiltration methodology.

Browser History Confirmation. Browser history analysis on all eight CRH-issued devices confirms access to personal cloud storage accounts — including personal Hollowell Health IT and personal Larkspur Technologies — and upload activity corresponding to the download timestamps identified in the CRH Aldermere Systems and Pinnacle Health IT access logs. This temporal correlation between cloud environment downloads and personal cloud storage uploads provides direct forensic evidence linking the CRH system downloads to the personal cloud storage transfers. The browser history data also reveals that several employees accessed their personal cloud storage accounts during normal business hours while logged into CRH's corporate network, further demonstrating the brazen nature of the exfiltration activity.

USB Device Connection Logs. Three of the eight CRH-issued devices — those belonging to Halvorsen, Tsao, and Johansson — show USB device connection logs indicating that external storage devices were connected during the exfiltration window. The connection timestamps correspond to dates during the Phase 3 exfiltration period (January 28 – February 4, 2025), suggesting that these individuals supplemented their cloud-based exfiltration with physical media transfers. The USB connection logs record device identifiers for the external storage devices, but the specific devices have not been recovered or imaged, as they were not returned to CRH as part of the offboarding process. Recovery of these devices through discovery will be critical to determining the full scope of data exfiltration.

Evidence of Partial File Deletion. Several CRH-issued devices showed evidence of partial deletion of files from local download folders prior to the devices being returned to CRH. This suggests that at least some of the departing employees attempted to remove evidence of their download activity before surrendering their devices. However, Pinnacle was able to recover metadata confirming the prior existence of the deleted files and their transfer to personal cloud storage accounts. The file metadata, including file names, sizes, creation dates, and modification dates, was recovered through standard forensic recovery techniques applied to the devices' storage media. The partial deletion efforts, while ultimately unsuccessful in concealing the exfiltration activity, provide additional evidence of the departing employees' awareness that their conduct was improper.

Email Metadata Review. Pinnacle's review of email metadata from CRH Outlook accounts for the final thirty days of each departing employee's employment revealed no evidence that the departing employees forwarded confidential CRH files via CRH corporate email to external email addresses. The exfiltration was conducted exclusively through cloud storage transfer and USB device methods, bypassing the corporate email system entirely. This finding is consistent with a deliberate decision by the Rathore Group to avoid CRH's email-based data loss prevention ("DLP") monitoring tools, which are configured to flag outbound email attachments containing certain categories of sensitive content. The choice to use cloud storage and USB transfer methods, rather than email, further suggests awareness and intentional circumvention of CRH's security controls.

VI. Correlation with Known Recruitment Timeline

The exfiltration timeline identified by Pinnacle aligns closely and consistently with the recruitment timeline as independently identified by Aurelian Investigations Group Inc. ("Aurelian"). Aurelian was engaged by C&H on behalf of CRH on February 21, 2025, and is led by Sandra Fielding, a former federal law enforcement investigator. Aurelian's investigation has focused on the factual chronology of the Verdana recruitment effort, and its preliminary findings to date provide critical context for interpreting the forensic data exfiltration timeline.

The key events on the recruitment and exfiltration timelines, presented in chronological order, are as follows:

• January 6, 2025: Priya Rathore attended a dinner meeting with Warren Dietrich (CEO, Verdana Commerce Group) and Elliot Westbrook (Managing Partner, Greystone Capital Partners, a significant equity investor in Verdana) at a restaurant in New York City. Aurelian identified this meeting through open-source investigation and witness interviews. The dinner meeting appears to represent the initial recruitment overture to Rathore and the point at which the departure plan was first proposed or discussed.

• January 10, 2025: First detected data exfiltration activity. Just four days after the recruitment dinner, Rathore began downloading high-level strategic documents, including Project Ridgeline master presentations, from CRH's Aldermere Systems environment. The proximity in time between the recruitment dinner and the onset of data exfiltration strongly suggests a direct causal connection.

• January 13–24, 2025: Encrypted messaging exchanges among the Rathore Group. Aurelian's investigation has identified evidence that members of the Rathore Group communicated via encrypted messaging applications (Signal and Meridian Services Inc.) during this period to discuss departure timing, recruitment of additional team members, and logistical arrangements. These communications overlapped with Phase 1 and the early portion of Phase 2 of the data exfiltration activity.

• January 27, 2025: Rathore signed her Verdana offer letter. The offer terms, as identified by Aurelian, include a base salary of $650,000, a sign-on bonus of $1,500,000, a target annual bonus of 80% of base salary (equating to $520,000 at target), and 1.5% of Verdana's fully diluted equity. These extraordinary compensation terms — particularly the $1,500,000 sign-on bonus and the equity grant — suggest that Verdana placed significant value on Rathore's departure from CRH and the intelligence she was expected to bring with her.

• January 28 – February 4, 2025: The remaining seven members of the Rathore Group signed their respective Verdana offer letters. The aggregate sign-on bonuses for all eight departing employees total approximately $6,200,000. This period corresponds precisely to Phase 3 of the data exfiltration activity, the period of highest download volume.

• February 4, 2025: Last detected data exfiltration activity. The cessation of exfiltration on February 4 — three days before the resignations — suggests that the data collection effort was considered complete by that date.

• February 7, 2025: Simultaneous resignations submitted by all eight members of the Rathore Group at 4:47 PM PST.

The temporal correlation between the recruitment timeline and the exfiltration timeline is striking and strongly supports the inference that the data exfiltration was planned and executed in direct connection with the Rathore Group's coordinated departure to Verdana. The exfiltration commenced within days of the initial recruitment overture, escalated as additional team members were recruited and signed offer letters, and ceased only when the departure was imminent. This pattern is inconsistent with any innocent explanation for the data downloads and points instead to a deliberate, coordinated scheme to extract CRH's most valuable competitive intelligence in advance of a group departure to a direct competitor.

VII. Implications for Litigation

A. Breach of Confidentiality Obligations

Each departing employee's employment agreement with CRH contains perpetual confidentiality obligations that survive the termination of employment. These obligations broadly prohibit the unauthorized removal, copying, retention, or disclosure of CRH confidential information, which is defined in each agreement to include trade secrets, business strategies, vendor relationships, pricing information, customer data, and other proprietary business information. The Rathore Agreement, for example, defines "Confidential Information" to include "all information relating to the Company's business, operations, strategies, products, services, vendors, customers, financial condition, and technology" that is not generally known to the public, and it prohibits Rathore from "removing, copying, or transmitting any Confidential Information from the Company's systems or premises for any purpose other than the performance of [her] duties."

Pinnacle's forensic findings establish that all eight departing employees downloaded CRH proprietary data from CRH systems to personal cloud storage accounts — and, in three cases, to external USB devices — during the period when they were actively planning and executing their departure to a direct competitor. This conduct constitutes a clear and unambiguous violation of the confidentiality obligations in each employee's employment agreement. The files downloaded encompass the full spectrum of information covered by the confidentiality definitions in the employment agreements, including strategic plans, vendor negotiation data, private-label cost models, customer analytics, and operational documents.

B. Misappropriation of Trade Secrets Under DUTSA

The exfiltrated materials are strong candidates for protection as trade secrets under the Delaware Uniform Trade Secrets Act, 6 Del. C. § 2001 et seq. ("DUTSA"). DUTSA defines a "trade secret" as information that derives independent economic value from not being generally known to or readily ascertainable by persons who can obtain economic value from its disclosure or use, and that is the subject of reasonable efforts to maintain its secrecy. CRH maintains robust information security measures, including access controls, password protection, network security, and employee confidentiality agreements, that satisfy the "reasonable efforts" requirement.

The following categories of exfiltrated materials are particularly strong trade secret candidates:

• Project Ridgeline documents — representing CRH's five-year strategic plan, which derives substantial independent economic value from its confidentiality and which was developed at significant cost over a fourteen-month period;

• Vendor negotiation term sheets — containing CRH's proprietary negotiation strategies and confidential commercial terms that are not publicly available;

• Private-label cost models — detailing CRH's proprietary sourcing economics and margin targets, which represent core competitive intelligence; and

• Seasonal buying algorithms — embodying proprietary analytical models developed over multiple years and constituting a key component of CRH's operational competitive advantage.

Pinnacle's findings provide concrete evidence of the "acquisition by improper means" element required under DUTSA, 6 Del. C. § 2001(1). The unauthorized downloading of CRH files to personal cloud storage accounts and external USB devices, in violation of CRH's Information Security Policy and each employee's contractual confidentiality obligations, constitutes acquisition through breach of a duty to maintain secrecy. To the extent the exfiltrated materials have been made available to Verdana — a fact that remains to be established through discovery — the "use or disclosure" elements of a DUTSA claim would also be satisfied.

A separate, more detailed analysis of DUTSA trade secret classification for each category of exfiltrated material is set forth in the Project Ridgeline Trade Secret Classification Analysis memorandum dated March 2, 2025, which should be read in conjunction with this memorandum.

C. Tortious Interference and Civil Conspiracy

The timing of the data exfiltration, commencing just four days after the January 6, 2025 Dietrich/Westbrook/Rathore recruitment dinner, supports claims of tortious interference with contractual relations against Verdana. If Verdana or its agents encouraged, directed, or facilitated the Rathore Group's extraction of CRH confidential information, Verdana may be liable for tortious interference with the employment agreements' confidentiality provisions. The extraordinary compensation packages offered by Verdana — including aggregate sign-on bonuses of $6,200,000 and equity grants — further support the inference that Verdana anticipated receiving substantial competitive value from the departing employees beyond their labor and expertise alone.

The coordinated nature of the data exfiltration also supports a civil conspiracy claim against all defendants. The Pinnacle findings demonstrate that each member of the Rathore Group systematically collected materials from their functional area of responsibility during a concentrated twenty-six-day window, using the same methodology, and in temporal coordination with each other. This pattern of parallel, functionally partitioned data collection suggests an organized plan rather than individual, opportunistic behavior by separate employees acting independently. The encrypted messaging exchanges among the Rathore Group during the January 13–24, 2025 period further support the existence of a coordinated agreement to misappropriate CRH data.

D. Support for TRO / Preliminary Injunction

Pinnacle's forensic findings provide strong evidentiary support for CRH's anticipated motion for a temporary restraining order and preliminary injunction in the Delaware Court of Chancery, C.A. No. 2025-0198-MTZ. The findings are relevant to the key elements of a TRO and preliminary injunction analysis as follows:

Likelihood of Success on the Merits. The forensic evidence establishes a strong factual foundation for CRH's claims of breach of contract (confidentiality obligations), trade secret misappropriation under DUTSA, tortious interference, and civil conspiracy. The data exfiltration is clearly documented through system access logs, browser history, USB connection logs, and device forensic imaging.

Irreparable Harm. The data exfiltration demonstrates irreparable harm of the most concrete and immediate kind. CRH's most sensitive competitive intelligence — including its five-year strategic plan, vendor negotiation terms, private-label cost models, customer segmentation data, and seasonal buying algorithms — is now in the possession of employees who have joined a direct competitor that has specifically and publicly targeted CRH's strongest product categories for expansion. The harm resulting from the disclosure or use of this information by Verdana cannot be adequately remedied by monetary damages alone, as the competitive advantage lost through disclosure of trade secrets is inherently difficult to quantify and, once lost, cannot be restored.

Balance of Equities. The balance of equities favors CRH, as the requested relief — return or destruction of exfiltrated data, enforcement of restrictive covenants, and a forensic audit of Verdana's systems — would merely require the defendants to comply with their pre-existing contractual and legal obligations.

Public Interest. The public interest favors the enforcement of contractual obligations, the protection of trade secrets, and the deterrence of coordinated data theft by departing employees.

Dr. Rajiv Anand has indicated his willingness to provide a sworn declaration attesting to the Pinnacle forensic findings in support of CRH's TRO application. The declaration should be drafted in coordination with Pinnacle and should include a detailed description of Dr. Anand's qualifications, the methodology employed in the forensic investigation, and the key findings summarized in this memorandum.

VIII. Outstanding Items and Next Steps

The following items remain outstanding and require attention in the near term:

Pinnacle Supplemental Report. Pinnacle's final supplemental report is expected by approximately March 10, 2025, and will include the following additional analyses:

(a) Hash-Value Analysis. Detailed hash-value analysis of specific high-sensitivity files to establish file integrity and confirm that the exfiltrated files are exact copies of the CRH originals. Hash-value verification will be critical for evidentiary purposes in establishing that the files in the defendants' possession are identical to CRH's proprietary originals.

(b) USB Device Data Recovery. Attempted recovery and analysis of data from the three identified USB external storage devices (those connected to the Halvorsen, Tsao, and Johansson devices), if and when those devices can be obtained through discovery or court order. Pinnacle has the device identifiers from the USB connection logs and can match recovered devices to the forensic records.

(c) Non-CRH Device Access Analysis. Analysis of any additional access to CRH cloud environments from non-CRH devices using CRH credentials, including personal laptops, personal mobile devices, or other devices not returned to CRH. This analysis will be based on IP address and device fingerprint data in the CRH access logs and may reveal additional exfiltration pathways beyond those documented in the Preliminary Report.

Declaration of Dr. Rajiv Anand. It is recommended that Pinnacle's forensic findings be incorporated into a sworn Declaration of Dr. Rajiv Anand to be filed in support of CRH's TRO motion in the Delaware Court of Chancery. The declaration should be prepared in coordination with Pinnacle and should be finalized promptly upon receipt of the supplemental report, or sooner if the litigation timetable requires.

Economic Damages Quantification. CRH has engaged Veltrano Consulting Group LLC ("Veltrano"), under the direction of Dr. Franklin Oberg, effective March 3, 2025, to develop an economic damages quantification model for the data exfiltration and trade secret misappropriation. The Pinnacle forensic findings should be shared with Veltrano (subject to appropriate privilege protections) to enable Veltrano to incorporate the scope and nature of the exfiltrated data into its damages analysis.

Injunctive Relief Considerations. It is recommended that CRH's TRO and preliminary injunction motion include a request for the following specific relief:

(a) An order compelling each member of the Rathore Group and Verdana Commerce Group, Inc. to immediately return or destroy all copies of CRH data in their possession, custody, or control, including data stored on personal cloud storage accounts, personal devices, and external storage media;

(b) An order compelling Verdana to submit to an independent forensic audit of its systems, to be conducted by a court-appointed or mutually agreed forensic examiner, to determine whether CRH data has been uploaded, accessed, or integrated into Verdana's systems; and

(c) An order enforcing the restrictive covenant provisions in each departing employee's employment agreement, including non-competition and non-solicitation obligations, pending further proceedings.

Chain of Custody Preservation. All chain-of-custody documentation for the forensically imaged CRH-issued devices and the CRH cloud environment access logs must be preserved and maintained in the matter file. Pinnacle has confirmed that its chain-of-custody protocols are consistent with the requirements of the Federal Rules of Evidence and Delaware Rules of Evidence, and that all forensic images and associated documentation are maintained in Pinnacle's secure evidence repository.

IX. Attachments (Referenced but Not Reproduced)

The following documents are referenced in this memorandum but are not reproduced herein. All attachments are maintained in the privileged and confidential matter file, 1038-00006.

Attachment 1: Pinnacle Forensics LLC Preliminary Forensic Report (dated February 28, 2025). Privileged and confidential; prepared at the direction of counsel in anticipation of litigation. Maintained in the C&H matter file.

Attachment 2: Summary Table of Exfiltrated Files by Employee, Date, Source System, and Data Category. Prepared by Pinnacle Forensics LLC as an appendix to the Preliminary Forensic Report. This table provides a line-by-line breakdown of file-level exfiltration activity attributable to each departing employee.

Attachment 3: Access Log Excerpts (Aldermere Systems and Pinnacle Health IT) for January 10 – February 4, 2025. Produced by Pinnacle Forensics LLC from CRH's cloud environment access log data. These excerpts document the specific download events, timestamps, user credentials, source file paths, and destination indicators for the exfiltration activity described in this memorandum.

Attachment 4: Device Imaging Chain of Custody Records. These records document the transfer of CRH-issued devices from CRH's IT department to Pinnacle Forensics, the forensic imaging process, and the current location and

PRIVILEGED AND CONFIDENTIAL – ATTORNEY WORK PRODUCT Prepared at the direction of counsel in anticipation of litigation. Do not forward or distribute without authorization.
CALDERWOOD & HARKNESS LLP 1301 K Street NW, Suite 1200 Washington, DC 20005
Matter No.: 1038-00006 Date: March 1, 2025
TO: Bernard Crawford, Responsible Partner, Labor & Employment
FROM: Devon Archer, Working Associate, Labor & Employment
RE: Summary of Pinnacle Forensics LLC Preliminary Findings – Data Exfiltration by Rathore Group from Cascade Retail Holdings Inc. Systems
PRIVILEGED AND CONFIDENTIAL – ATTORNEY WORK PRODUCT. This memorandum has been prepared at the direction of counsel in anticipation of litigation. It is protected by the attorney-client privilege and the attorney work product doctrine. Do not forward or distribute without authorization from the Responsible Partner.
I. Executive Summary
The purpose of this memorandum is to summarize the preliminary forensic findings of Pinnacle Forensics LLC ("Pinnacle"), as communicated to Calderwood & Harkness LLP ("C&H") in Pinnacle's preliminary report delivered on February 28, 2025 (the "Preliminary Report"). The Pinnacle engagement is led by Dr. Rajiv Anand, a certified digital forensics examiner with over twenty years of experience in corporate data theft investigations. This memorandum is intended to provide a comprehensive overview of Pinnacle's findings to date for the purpose of informing litigation strategy and supporting potential court filings on behalf of our client, Cascade Retail Holdings Inc. ("CRH"), in the pending action filed in the Delaware Court of Chancery, C.A. No. 2025-0198-MTZ.
Pinnacle was retained by C&H on February 20, 2025, on behalf of CRH, to conduct forensic imaging of all CRH-issued computing devices returned by eight departing employees and to analyze CRH cloud environment access logs and data exfiltration patterns. The engagement followed CRH's discovery that a group of eight senior merchandising employees — led by Priya Rathore, CRH's former Senior Vice President of Merchandising — had resigned simultaneously on February 7, 2025, and joined Verdana Commerce Group, Inc. ("Verdana" or "VCG"), a direct competitor headquartered in Wilmington, Delaware.
The headline finding of the Pinnacle Preliminary Report is as follows: a total of 14,327 files comprising approximately 2.8 gigabytes of data were downloaded from CRH's Sundial Systems and Pinnacle Health IT environments to personal cloud storage accounts between January 10, 2025 and February 4, 2025. The exfiltrated files include materials that are among the most competitively sensitive in CRH's possession, including Project Ridgeline strategic presentations, vendor negotiation term sheets, private-label cost models, customer segmentation data, and seasonal buying algorithms. These materials collectively represent the core intellectual capital of CRH's merchandising division, which accounted for $2.3 billion in gross merchandise value in fiscal year 2024.
The exfiltration activity was conducted by multiple members of the departing merchandising team (referred to herein as the "Rathore Group") in a pattern that appears to be coordinated in both timing and methodology. Each departing employee systematically downloaded files within their specific functional area of responsibility, and the exfiltration activity commenced just four days after a recruitment dinner meeting between Rathore and senior leaders of Verdana and its primary financial backer, Greystone Capital Partners. The temporal alignment between the recruitment timeline and the data exfiltration timeline strongly supports the inference that the data theft was planned and executed in connection with the Rathore Group's coordinated departure to Verdana.
This memorandum is prepared to support litigation strategy and potential court filings in the Delaware Court of Chancery, C.A. No. 2025-0198-MTZ, including CRH's anticipated motion for a temporary restraining order and preliminary injunction.
II. Background
A. The Departing Employees
On February 7, 2025, at 4:47 PM PST, eight senior employees of CRH's merchandising division submitted simultaneous resignation letters via email, each stating that the resignation was effective immediately. The simultaneous timing of the resignations — all eight emails were sent within a sixty-second window — itself suggests a high degree of coordination among the departing employees.
The departures were led by Priya Rathore, CRH's former Senior Vice President of Merchandising. Rathore was employed by CRH from June 3, 2019 through February 7, 2025, a tenure of approximately five years and eight months. Rathore was a member of CRH's senior leadership team and reported directly to CRH's Chief Operating Officer, Michael Houghton. During her tenure, Rathore had access to virtually all strategic, financial, and operational information relating to CRH's merchandising division. She was the executive sponsor of Project Ridgeline, CRH's five-year strategic category expansion plan, and was intimately involved in its development from inception through its completion in October 2024.
Rathore signed an Amended and Restated Employment Agreement on March 15, 2021 (the "Rathore Agreement"), which contains robust restrictive covenant provisions, including an eighteen-month post-termination non-competition covenant, a twenty-four-month post-termination non-solicitation covenant (covering both employees and business relationships), and a perpetual confidentiality obligation covering all proprietary and confidential information of CRH. The Rathore Agreement is governed by Delaware law and contains a forum selection clause designating the Delaware Court of Chancery as the exclusive forum for disputes arising under the agreement.
The seven other departing employees, together with Rathore collectively constituting the "Rathore Group," are as follows:
1. Derek Linden — Vice President, Hardlines Merchandising. Employed by CRH for approximately seven years. Linden oversaw CRH's hardlines merchandising strategy, including vendor relationships, pricing, and competitive positioning across hardware, outdoor, and home improvement categories.
2. Sonia Kaczmarek — Vice President, Softlines Merchandising. Employed by CRH for approximately five years. Kaczmarek managed CRH's softlines merchandising portfolio, including seasonal apparel, home textiles, and related soft goods categories.
3. Amara Osei — Director, Private Label Strategy. Employed by CRH for approximately four years. Osei was responsible for CRH's private-label brand portfolio, including sourcing strategies, manufacturer relationships, cost modeling, and margin architecture for CRH's proprietary brands.
4. Brent Halvorsen — Director, Seasonal Planning & Analytics. Employed by CRH for approximately six years. Halvorsen led CRH's seasonal buying cycle planning, demand forecasting, and inventory optimization functions, utilizing proprietary analytical models and algorithms developed during his tenure.
5. Lucia Fernandez-Gill — Director, Vendor Relations (Domestic). Employed by CRH for approximately five years. Fernandez-Gill managed CRH's domestic vendor relationship portfolio, including vendor negotiations, term sheets, rebate programs, and exclusivity arrangements.
6. Nathan Tsao — Senior Manager, eCommerce Merchandising. Employed by CRH for approximately three years. Tsao was responsible for CRH's ecommerce assortment strategy, pricing optimization algorithms, and online merchandising playbooks for CRH's direct-to-consumer digital platform.
7. Kira Johansson — Senior Manager, Category Analytics. Employed by CRH for approximately four years. Johansson led CRH's category analytics function, producing customer segmentation models, purchase pattern analyses, market share assessments, and lifetime value calculations that informed CRH's merchandising and marketing strategies.
All eight departing employees left CRH to join Verdana Commerce Group, Inc. Verdana is a direct competitor of CRH in the retail sector, headquartered in Wilmington, Delaware. Verdana publicly announced the hiring of all eight former CRH employees in a press release issued on February 14, 2025, one week after the coordinated resignations. The press release described the hires as part of Verdana's "transformational growth initiative" and specifically highlighted the team's expertise in merchandising strategy, private-label development, and data-driven category management — all areas that directly correspond to CRH's core competitive strengths.
Each of the seven other departing employees, like Rathore, executed employment agreements with CRH that contain confidentiality obligations and restrictive covenant provisions. All such agreements are governed by Delaware law. The specific terms of each employee's restrictive covenants vary in duration, but all include post-termination non-competition periods of at least twelve months, non-solicitation periods of at least eighteen months, and perpetual confidentiality obligations.
B. CRH's discovery of Potential Data Theft
On February 10, 2025, three days after the simultaneous resignations, CRH's Chief People Officer, Roland Ashby, formally alerted CRH's General Counsel, Theresa Yun-Park, to the coordinated nature of the departures and the potential risk of data theft and competitive harm. Ashby noted that the simultaneous resignations of eight senior employees to a single direct competitor were unprecedented in CRH's corporate history and suggested the departures were the result of a deliberate and coordinated recruitment effort by Verdana.
On February 12, 2025, CRH's in-house legal team completed its initial review and confirmed the restrictive covenant provisions contained in each departing employee's employment agreement. On the same date, CRH's Information Technology department, at the direction of Yun-Park, conducted a preliminary review of system access logs and identified anomalous data access and download activity in the weeks preceding the resignations. Specifically, CRH's IT department observed a marked increase in file download volumes from CRH's Aldermere Systems and Pinnacle Health IT environments during the January 10 through February 4, 2025 period, with download volumes for several of the departing employees' accounts exceeding their historical averages by a factor of ten or more. These initial findings prompted CRH to seek outside counsel and forensic expertise immediately.
CRH retained Calderwood & Harkness LLP on February 18, 2025, and the firm opened this matter under number 1038-00006 on the same date. Following an initial assessment by the C&H team and a discussion with CRH's General Counsel, C&H engaged Pinnacle Forensics LLC on February 20, 2025 to conduct a comprehensive forensic investigation of the suspected data exfiltration.
C. Scope of Pinnacle Engagement
The Pinnacle engagement, as defined in the February 20, 2025 engagement letter, encompasses the following work streams:
1. Device Forensic Imaging. Forensic imaging of all CRH-issued laptops and mobile devices returned by the eight departing employees following their February 7, 2025 resignations. Pinnacle received custody of these devices on February 21, 2025, and completed forensic imaging by February 24, 2025, following chain-of-custody protocols consistent with Federal Rules of Evidence standards.
2. Cloud Environment Access Log Analysis. Analysis of CRH cloud environment access logs for Sundial Systems (CRH's corporate document management system) and Pinnacle Health IT (CRH's vendor relationship management and customer data platform) for the period of October 1, 2024 through February 7, 2025. The analysis window extends back to October 1, 2024 to establish baseline access patterns for each departing employee and to identify any anomalous activity that predates the January 10, 2025 start date of the concentrated exfiltration window.
3. File Download and Transfer Cataloguing. Identification and cataloguing of all files downloaded, transferred, or accessed in an unusual pattern during the analysis period, with particular attention to bulk downloads, downloads to non-CRH destinations, and downloads outside of normal business hours.
4. USB Device and External Storage Analysis. Analysis of USB device connections and external storage device usage on all CRH-issued devices, including identification of connected device types, connection timestamps, and associated file transfer activity.
5. Email Metadata Review. Review of email metadata and outbound communications from CRH email accounts (Microsoft) for the final thirty days of each departing employee's employment, with a focus on identifying any transmission of confidential files or information to external addresses.
Pinnacle delivered its Preliminary Report to Calderwood & Harkness on February 28, 2025. The Preliminary Report addresses all five work streams described above and presents findings based on the data analyzed to date. Pinnacle has indicated that a final supplemental report is expected by approximately March 10, 2025, which will include additional analysis as described in Section VIII below.
III. Summary of Forensic Findings
A. Overall Data Exfiltration Volume
Pinnacle's Preliminary Report identifies a total of 14,327 files exfiltrated from CRH systems during the period of January 10, 2025 through February 4, 2025. The total data volume of the exfiltrated files is approximately 2.8 gigabytes. While the data volume in gigabytes may appear modest in absolute terms, the nature and sensitivity of the files — which consist primarily of document files, spreadsheets, presentations, and structured data exports rather than large media files — render the volume highly significant from a competitive intelligence standpoint. As Dr. Anand noted in the Preliminary Report, the exfiltrated file set constitutes a "comprehensive operational and strategic intelligence package" for CRH's merchandising division.
The source systems from which the files were exfiltrated are CRH's Sundial Systems environment, which serves as CRH's primary corporate document management system for the merchandising division, and CRH's Pinnacle Health IT environment, which serves as CRH's vendor relationship management platform and contains customer data, vendor contact information, and relationship management records.
The destination of the exfiltrated files was personal cloud storage accounts not associated with CRH's corporate infrastructure. The primary destinations were personal Hollowell Health IT accounts and personal Larkspur Technologies accounts maintained by the departing employees. These personal cloud storage services are not authorized for use in connection with CRH business, and CRH's Information Security Policy (revised January 2024) expressly prohibits the transfer of confidential business information to personal cloud storage accounts.
The exfiltration window spans twenty-six calendar days, from January 10, 2025 through February 4, 2025. The start date of January 10, 2025 is particularly noteworthy because it falls just four days after the January 6, 2025 dinner meeting between Verdana CEO Warren Dietrich, Greystone Capital Partners Managing Partner Elliot Westbrook, and Priya Rathore at a restaurant in New York City. That dinner meeting, which has been identified and documented by Aurelian Investigations Group Inc. (discussed further in Section VI below), appears to represent the initiating event in the Rathore Group's coordinated departure and, based on the temporal proximity, the catalyst for the data exfiltration campaign that began four days later.
B. Exfiltration by Individual Employee
Pinnacle's Preliminary Report provides a detailed breakdown of the files attributed to each departing employee's CRH user credentials. The following summarizes the key findings for each individual:
Priya Rathore — Rathore accounts for the largest volume of downloads among the eight departing employees. Rathore accessed and downloaded files across all data categories identified by Pinnacle, reflecting her senior leadership role and her broad access permissions within CRH's systems. Her downloads include the complete Project Ridgeline file set (all 847 files), executive-level vendor negotiation term sheets that were restricted to VP-level and above access, and the five-year category expansion roadmap presentations that she had helped develop in her capacity as executive sponsor of Project Ridgeline. Rathore's download activity was concentrated in two primary clusters: January 10–15, 2025, when she accessed and downloaded high-level strategic documents; and January 27–February 3, 2025, when she conducted a second, broader sweep of files that included operational documents and additional vendor data. The January 27 date is significant because it is the date on which Rathore signed her offer letter with Verdana, suggesting that she undertook a final comprehensive collection of CRH materials upon formal acceptance of the competing position.
Derek Linden — Linden's downloads were focused on hardlines merchandising data, consistent with his functional area of responsibility as VP of Hardlines Merchandising. The downloaded files include vendor pricing schedules for CRH's top fifty hardlines vendors, competitive positioning analyses comparing CRH's hardlines assortment and pricing against key competitors (including Verdana), and category-specific margin analyses for hardware, outdoor, and home improvement product lines. Linden's download activity was concentrated in the January 22–30, 2025 period.
Sonia Kaczmarek — Kaczmarek's downloads were focused on softlines merchandising data, including seasonal buy plans covering the Spring/Summer 2025 and Fall/Winter 2025 buying cycles, margin analysis workbooks for CRH's softlines categories, and vendor allocation models. The seasonal buy plans in particular represent time-sensitive, forward-looking competitive intelligence that could provide Verdana with immediate insight into CRH's upcoming merchandising strategies. Kaczmarek's download activity was concentrated in the January 20–28, 2025 period.
Amara Osei — Osei downloaded the entirety of the private-label sourcing strategy file repository maintained on CRH's Aldermere Systems environment. This repository includes private-label cost models for all of CRH's proprietary brands, manufacturer agreements and correspondence, quality scorecards for private-label suppliers, and margin target documents setting forth CRH's profitability objectives for its private-label portfolio. Osei's downloads represent a complete extraction of CRH's private-label intellectual property and sourcing infrastructure. Osei's download activity was concentrated in the January 22 – February 2, 2025 period.
Brent Halvorsen — Halvorsen downloaded seasonal planning algorithms, demand forecasting models, and historical analytics dashboards from CRH's Aldermere Systems environment. These materials include proprietary algorithmic models developed by CRH's analytics team over several years and refined by Halvorsen during his six-year tenure. The demand forecasting models, in particular, represent significant intellectual investment by CRH and are central to CRH's inventory optimization and seasonal planning capabilities. Halvorsen's download activity was concentrated in the January 24 – February 3, 2025 period. Additionally, USB device connection logs on Halvorsen's CRH-issued laptop indicate that an external storage device was connected and used for file transfer on January 31, 2025 and February 2, 2025.
Lucia Fernandez-Gill — Fernandez-Gill downloaded domestic vendor contact databases, vendor negotiation term sheets for CRH's top one hundred domestic vendor relationships, and relationship management notes maintained in CRH's Pinnacle Health IT environment. The vendor contact databases include proprietary contact information for key decision-makers at each vendor, negotiation history, and relationship notes that are not publicly available. The term sheets include CRH's negotiated pricing, volume discount thresholds, exclusivity arrangements, and rebate schedules — all of which represent confidential commercial terms that could be exploited by a competitor in head-to-head vendor negotiations. Fernandez-Gill's download activity was concentrated in the January 25 – February 4, 2025 period.
Nathan Tsao — Tsao downloaded ecommerce merchandising playbooks, pricing optimization algorithms, and online assortment strategy documents from CRH's Aldermere Systems environment. The pricing optimization algorithms are proprietary models developed by CRH's ecommerce team to manage dynamic pricing across CRH's direct-to-consumer platform, and the assortment strategy documents detail CRH's category-level plans for online product selection and curation. Tsao's download activity was concentrated in the January 26 – February 3, 2025 period. USB device connection logs on Tsao's CRH-issued laptop indicate that an external storage device was connected on February 1, 2025.
Kira Johansson — Johansson downloaded category analytics reports, customer segmentation data, and market-share analysis models from both CRH's Aldermere Systems and Pinnacle Health IT environments. The customer segmentation data includes proprietary models classifying CRH's customer base by demographics, purchase behavior, engagement frequency, and estimated lifetime value — data that represents years of investment in analytics infrastructure and data science capabilities. Johansson's download activity was concentrated in the January 24 – February 4, 2025 period. USB device connection logs on Johansson's CRH-issued laptop indicate that an external storage device was connected on January 30, 2025 and February 3, 2025.
Pattern Observation: As Dr. Anand observes in the Preliminary Report, each employee appears to have focused their downloads on materials directly within their functional area of responsibility. This pattern is inconsistent with incidental or casual access and strongly suggests systematic, deliberate, and purposeful collection of CRH trade secrets and confidential information. The functional specificity of each employee's downloads implies that the Rathore Group members were each assigned — or independently undertook — the task of extracting the materials most relevant to their particular expertise, resulting in a collectively comprehensive exfiltration of CRH's merchandising division's intellectual capital.
C. Exfiltration Timeline and Methodology
Pinnacle's Preliminary Report identifies three distinct phases of the data exfiltration activity, each corresponding to key events in the recruitment and departure timeline:
Phase 1 — January 10–15, 2025 (Initial Strategic Document Collection). The first phase of exfiltration activity is attributable primarily to Priya Rathore and involves the download of high-level strategic documents, most notably the Project Ridgeline master presentations and related strategic planning materials. This phase coincides with the period immediately following the January 6, 2025 dinner meeting between Rathore, Verdana CEO Warren Dietrich, and Greystone Capital Partners Managing Partner Elliot Westbrook. The Phase 1 activity also overlaps with the encrypted messaging exchanges among the Rathore Group that took place during the January 13–24, 2025 period (as identified by Aurelian Investigations Group). The nature of the Phase 1 downloads — focused on the most senior-level strategic materials — suggests that Rathore was collecting CRH's highest-value strategic intelligence in the immediate aftermath of the recruitment overture.
Phase 2 — January 20–28, 2025 (Broadening Across Team Members). The second phase marks the expansion of exfiltration activity beyond Rathore to multiple members of the departing team. During this period, Linden, Kaczmarek, Osei, Halvorsen, Fernandez-Gill, Tsao, and Johansson each begin significant download activity from CRH systems. The downloads during Phase 2 expand beyond strategic documents to include operational data sets, vendor term sheets, cost models, and analytical tools. Notably, Rathore signed her Verdana offer letter on January 27, 2025, during Phase 2, and the broadening of exfiltration activity across the full team suggests that the other Rathore Group members were progressively recruited and began their own data collection efforts as the departure plan solidified.
Phase 3 — January 28 – February 4, 2025 (Highest Volume; Final Collection). The third and final phase represents the period of highest download volume. During this phase, all remaining seven employees signed their Verdana offer letters (between January 28 and February 4, 2025), and the final data pulls included customer segmentation files, category analytics reports, and other materials that completed the comprehensive extraction of CRH's merchandising division data. The exfiltration activity ceased on February 4, 2025, three days before the simultaneous resignations on February 7, 2025. The cessation of activity on February 4 suggests that the Rathore Group considered their data collection to be complete by that date and shifted their focus to the logistics of the coordinated departure.
Methodology Observed. Pinnacle's analysis of the exfiltration methodology reveals a consistent pattern across all eight departing employees. The employees accessed CRH's Aldermere Systems and Pinnacle Health IT environments using their valid CRH-issued credentials from CRH-issued devices during the normal course of their employment. Files were downloaded from the cloud environments to local storage on the CRH-issued laptops. The files were then transferred from local storage to personal cloud storage accounts — primarily personal Hollowell Health IT and personal Larkspur Technologies accounts — that are not associated with CRH's corporate infrastructure and are not authorized for use with CRH data under CRH's Information Security Policy.
Several employees used browser-based upload interfaces to transfer files to their personal Hollowell Health IT accounts, which left clear and readily identifiable access log trails in both the CRH cloud environment logs and the browser histories on the CRH-issued devices. Others used desktop client applications for cloud storage services that had been installed on CRH-issued devices. Specifically, Rathore's CRH-issued laptop had the Hollowell Health IT desktop client application installed, and Osei's and Fernandez-Gill's CRH-issued laptops had the Larkspur Technologies desktop client application installed. The installation of personal cloud storage client applications on CRH-issued devices is a violation of CRH's Acceptable Use Policy.
In addition to cloud-based transfer, USB device connections were detected on three of the eight CRH-issued devices — those belonging to Halvorsen, Tsao, and Johansson — suggesting that these individuals also exfiltrated data via external storage media such as USB flash drives or external hard drives. The specific external storage devices have not been recovered or imaged, as they were not returned to CRH with the CRH-issued devices.
Pinnacle notes that there is no evidence that the departing employees attempted to delete system access logs, use anonymizing tools or VPN services to obscure their activity, or employ any other sophisticated obfuscation techniques. Dr. Anand characterizes the exfiltration as "brazen" in that it was conducted using normal CRH credentials, standard download processes, and readily traceable transfer methods. The absence of obfuscation efforts may reflect a belief on the part of the departing employees that their activity would not be detected before their departure, or it may simply reflect a lack of concern about detection — either interpretation underscores the deliberate nature of the data theft.
IV. Categories of Exfiltrated Data
Pinnacle's Preliminary Report classifies the 14,327 exfiltrated files into six principal categories based on subject matter. The following provides a detailed summary of each category, the approximate number of files involved, and the significance of the materials from CRH's competitive standpoint.
A. Project Ridgeline Materials
A total of 847 files are directly associated with "Project Ridgeline," CRH's five-year strategic category expansion plan. Project Ridgeline was developed over the course of approximately fourteen months, from August 2023 through October 2024, under the executive sponsorship of Priya Rathore and with significant contributions from the broader merchandising leadership team. It represents CRH's most comprehensive and forward-looking strategic planning effort, encompassing category-by-category analysis, financial projections, competitive positioning, and execution roadmaps.
The exfiltrated Project Ridgeline materials include the following subcategories of documents:
• Master strategy decks presented to CRH's Board of Directors in October 2024, containing the complete five-year strategic vision for CRH's merchandising division;
• Detailed financial projections, including revenue, margin, and profitability targets by category and by year for the 2025–2029 planning period;
• Category-by-category expansion timelines identifying target categories for growth, planned entry dates, investment requirements, and competitive benchmarking;
• Private-label margin targets establishing CRH's profitability objectives for its proprietary brand portfolio within each expansion category;
• eCommerce assortment algorithm specifications detailing the technical parameters and business logic underlying CRH's online merchandising optimization systems; and
• Vendor negotiation frameworks establishing CRH's strategic approach to vendor terms, including target pricing, volume commitments, exclusivity objectives, and co-marketing arrangements for the expansion categories.
The Rathore Group had full access to Project Ridgeline materials during their employment, as all eight employees were active contributors to or stakeholders in the project. These materials represent CRH's most competitively sensitive forward-looking strategic plans. CRH's merchandising division accounted for $2.3 billion in gross merchandise value in fiscal year 2024, and Project Ridgeline is designed to drive growth in the highest-value and highest-margin segments of CRH's business. The disclosure of Project Ridgeline materials to a direct competitor would provide that competitor with a detailed roadmap of CRH's strategic intentions, enabling preemptive competitive responses and fundamentally undermining the plan's viability.
B. Vendor Negotiation Term Sheets
Approximately 3,200 files relate to CRH's vendor negotiation playbooks and specific term sheets for active vendor agreements. This category includes the following types of materials:
• Proprietary negotiation strategies setting forth CRH's approach to vendor negotiations, including walk-away positions, concession sequences, and leverage points;
• Volume discount thresholds and tiered pricing structures negotiated with CRH's top vendors;
• Exclusivity arrangements granting CRH preferential or exclusive access to certain products, brands, or geographic territories;
• Rebate schedules and performance-based incentive structures negotiated with domestic and international vendors; and
• Vendor-specific negotiation histories and relationship notes maintained in CRH's Pinnacle Health IT environment.
The sensitivity of this category is particularly acute given the competitive dynamics between CRH and Verdana. The two companies directly compete in twenty-eight overlapping product categories, and many of CRH's vendor relationships involve the same manufacturers and distributors with which Verdana also transacts. Armed with CRH's vendor negotiation term sheets, Verdana would possess detailed knowledge of CRH's pricing, discount structures, and negotiation strategies, enabling Verdana to undercut CRH's vendor terms or to poach vendor relationships by offering marginally more favorable conditions. Verdana has publicly announced a "transformational growth initiative" targeting expansion into CRH's strongest categories, making the vendor negotiation data immediately actionable for Verdana's competitive purposes.
C. Private-Label Cost Models
Approximately 2,100 files relate to CRH's private-label sourcing strategies. CRH's private-label brand portfolio is one of the company's most significant competitive differentiators, and the materials exfiltrated in this category represent the proprietary intelligence underlying that advantage. The exfiltrated materials include:
• Manufacturer cost structures detailing CRH's negotiated unit costs for private-label products, including raw material costs, manufacturing costs, and packaging costs;
• Landed cost models incorporating shipping, customs duties, warehousing, and logistics costs for both domestic and international sourcing;
• Target margin architectures establishing CRH's profitability objectives for each private-label brand and product category;
• Supplier quality scorecards rating private-label manufacturers on quality, reliability, capacity, and compliance criteria; and
• Manufacturer agreements, including key commercial terms, volume commitments, and quality specifications.
CRH's private-label home goods and seasonal décor lines are identified in Project Ridgeline as CRH's strongest categories and highest-margin product lines. These are precisely the categories that Verdana has publicly targeted for expansion in its February 14, 2025 press release. With access to CRH's private-label cost models, Verdana would be able to replicate CRH's sourcing strategies, approach CRH's manufacturers with competitive offers, and develop competing private-label programs that directly undermine CRH's category advantage.
D. Customer Segmentation Data
Approximately 1,850 files contain CRH customer analytics data, representing a significant portion of CRH's data science and marketing intelligence infrastructure. The exfiltrated materials include:
• Customer segmentation models classifying CRH's customer base into behavioral and demographic segments;
• Purchase pattern analyses identifying purchasing frequency, basket composition, channel preferences, and seasonal buying tendencies across customer segments;
• Demographic profiling data linking customer segments to geographic, income, age, and lifestyle characteristics; and
• Lifetime value calculations estimating the long-term revenue and profitability contribution of each customer segment.
This data was downloaded primarily from CRH's Pinnacle Health IT environment and represents years of investment in analytics infrastructure, data collection, and data science capabilities. The customer segmentation data underpins CRH's ecommerce personalization strategies and targeted marketing campaigns across its 387 brick-and-mortar retail locations and its direct-to-consumer ecommerce platform. Access to this data would enable Verdana to target CRH's most valuable customer segments with precision and to develop competing marketing strategies calibrated to the specific behavioral and demographic characteristics of CRH's customer base.
E. Seasonal Buying Algorithms and Planning Data
Approximately 2,400 files relate to CRH's seasonal buying cycles, demand forecasting capabilities, and inventory management systems. The exfiltrated materials include:
• Seasonal buying algorithms governing CRH's purchasing decisions for seasonal product categories, including holiday, spring/summer, and back-to-school merchandise;
• Demand forecasting models incorporating historical sales data, macroeconomic indicators, weather patterns, and trend analysis to predict future demand at the category, product, and store level;
• Inventory optimization models designed to minimize carrying costs while maintaining target in-stock rates; and
• Historical purchasing data spanning multiple years of buying activity, providing the training data for CRH's algorithmic forecasting systems.
These materials were downloaded primarily by Halvorsen and Johansson, consistent with their respective functional responsibilities in seasonal planning and category analytics. The demand forecasting and inventory optimization models represent proprietary analytical tools that CRH has developed and refined over several years, and they constitute a core component of CRH's operational competitive advantage.
F. Other Confidential Business Information
The remaining approximately 3,930 files include miscellaneous operational documents that, while individually less sensitive than the foregoing categories, collectively provide a comprehensive operational picture of CRH's merchandising division. These files include:
• Internal meeting notes from merchandising leadership team meetings, strategy sessions, and vendor review meetings;
• Competitive intelligence reports analyzing the strategies, assortments, and pricing of CRH's key competitors (including Verdana);
• Personnel performance reviews for members of CRH's merchandising team, including talent assessments, succession planning documents, and compensation data; and
• Organizational planning documents, including headcount projections, budget allocations, and divisional restructuring plans.
While any one of these documents in isolation might be of limited competitive value, the aggregate collection provides Verdana with a detailed and multifaceted view of CRH's internal operations, organizational capabilities, talent pipeline, and competitive intelligence efforts. In combination with the higher-sensitivity categories described above, these materials complete a comprehensive intelligence dossier on CRH's merchandising division.
V. CRH Device Analysis
Following the February 7, 2025 resignations, CRH collected all CRH-issued laptops and mobile devices from the eight departing employees through CRH's standard offboarding process. The devices were secured by CRH's IT department and transferred to Pinnacle Forensics on February 21, 2025 pursuant to chain-of-custody protocols. Pinnacle completed forensic imaging of all devices by February 24, 2025, creating bit-for-bit forensic copies of each device's storage media for analysis while preserving the original devices in their received condition.
The key findings from Pinnacle's device analysis are as follows:
Personal Cloud Storage Application Installation. Several of the CRH-issued devices showed evidence of personal cloud storage application installation. Specifically, Rathore's CRH-issued laptop had the Hollowell Health IT desktop client application installed, and the laptops of Osei and Fernandez-Gill had the Larkspur Technologies desktop client application installed. The installation of personal cloud storage client applications on CRH-issued devices is prohibited under CRH's Acceptable Use Policy (Section 4.3, "Prohibited Software Installations"), which expressly restricts CRH-issued devices to software approved and provisioned by CRH's IT department. The presence of these applications facilitated the seamless transfer of downloaded CRH files to personal cloud accounts and provides additional evidence of the deliberate nature of the exfiltration methodology.
Browser History Confirmation. Browser history analysis on all eight CRH-issued devices confirms access to personal cloud storage accounts — including personal Hollowell Health IT and personal Larkspur Technologies — and upload activity corresponding to the download timestamps identified in the CRH Aldermere Systems and Pinnacle Health IT access logs. This temporal correlation between cloud environment downloads and personal cloud storage uploads provides direct forensic evidence linking the CRH system downloads to the personal cloud storage transfers. The browser history data also reveals that several employees accessed their personal cloud storage accounts during normal business hours while logged into CRH's corporate network, further demonstrating the brazen nature of the exfiltration activity.
USB Device Connection Logs. Three of the eight CRH-issued devices — those belonging to Halvorsen, Tsao, and Johansson — show USB device connection logs indicating that external storage devices were connected during the exfiltration window. The connection timestamps correspond to dates during the Phase 3 exfiltration period (January 28 – February 4, 2025), suggesting that these individuals supplemented their cloud-based exfiltration with physical media transfers. The USB connection logs record device identifiers for the external storage devices, but the specific devices have not been recovered or imaged, as they were not returned to CRH as part of the offboarding process. Recovery of these devices through discovery will be critical to determining the full scope of data exfiltration.
Evidence of Partial File Deletion. Several CRH-issued devices showed evidence of partial deletion of files from local download folders prior to the devices being returned to CRH. This suggests that at least some of the departing employees attempted to remove evidence of their download activity before surrendering their devices. However, Pinnacle was able to recover metadata confirming the prior existence of the deleted files and their transfer to personal cloud storage accounts. The file metadata, including file names, sizes, creation dates, and modification dates, was recovered through standard forensic recovery techniques applied to the devices' storage media. The partial deletion efforts, while ultimately unsuccessful in concealing the exfiltration activity, provide additional evidence of the departing employees' awareness that their conduct was improper.
Email Metadata Review. Pinnacle's review of email metadata from CRH Outlook accounts for the final thirty days of each departing employee's employment revealed no evidence that the departing employees forwarded confidential CRH files via CRH corporate email to external email addresses. The exfiltration was conducted exclusively through cloud storage transfer and USB device methods, bypassing the corporate email system entirely. This finding is consistent with a deliberate decision by the Rathore Group to avoid CRH's email-based data loss prevention ("DLP") monitoring tools, which are configured to flag outbound email attachments containing certain categories of sensitive content. The choice to use cloud storage and USB transfer methods, rather than email, further suggests awareness and intentional circumvention of CRH's security controls.
VI. Correlation with Known Recruitment Timeline
The exfiltration timeline identified by Pinnacle aligns closely and consistently with the recruitment timeline as independently identified by Aurelian Investigations Group Inc. ("Aurelian"). Aurelian was engaged by C&H on behalf of CRH on February 21, 2025, and is led by Sandra Fielding, a former federal law enforcement investigator. Aurelian's investigation has focused on the factual chronology of the Verdana recruitment effort, and its preliminary findings to date provide critical context for interpreting the forensic data exfiltration timeline.
The key events on the recruitment and exfiltration timelines, presented in chronological order, are as follows:
• January 6, 2025: Priya Rathore attended a dinner meeting with Warren Dietrich (CEO, Verdana Commerce Group) and Elliot Westbrook (Managing Partner, Greystone Capital Partners, a significant equity investor in Verdana) at a restaurant in New York City. Aurelian identified this meeting through open-source investigation and witness interviews. The dinner meeting appears to represent the initial recruitment overture to Rathore and the point at which the departure plan was first proposed or discussed.
• January 10, 2025: First detected data exfiltration activity. Just four days after the recruitment dinner, Rathore began downloading high-level strategic documents, including Project Ridgeline master presentations, from CRH's Aldermere Systems environment. The proximity in time between the recruitment dinner and the onset of data exfiltration strongly suggests a direct causal connection.
• January 13–24, 2025: Encrypted messaging exchanges among the Rathore Group. Aurelian's investigation has identified evidence that members of the Rathore Group communicated via encrypted messaging applications (Signal and Meridian Services Inc.) during this period to discuss departure timing, recruitment of additional team members, and logistical arrangements. These communications overlapped with Phase 1 and the early portion of Phase 2 of the data exfiltration activity.
• January 27, 2025: Rathore signed her Verdana offer letter. The offer terms, as identified by Aurelian, include a base salary of $650,000, a sign-on bonus of $1,500,000, a target annual bonus of 80% of base salary (equating to $520,000 at target), and 1.5% of Verdana's fully diluted equity. These extraordinary compensation terms — particularly the $1,500,000 sign-on bonus and the equity grant — suggest that Verdana placed significant value on Rathore's departure from CRH and the intelligence she was expected to bring with her.
• January 28 – February 4, 2025: The remaining seven members of the Rathore Group signed their respective Verdana offer letters. The aggregate sign-on bonuses for all eight departing employees total approximately $6,200,000. This period corresponds precisely to Phase 3 of the data exfiltration activity, the period of highest download volume.
• February 4, 2025: Last detected data exfiltration activity. The cessation of exfiltration on February 4 — three days before the resignations — suggests that the data collection effort was considered complete by that date.
• February 7, 2025: Simultaneous resignations submitted by all eight members of the Rathore Group at 4:47 PM PST.
The temporal correlation between the recruitment timeline and the exfiltration timeline is striking and strongly supports the inference that the data exfiltration was planned and executed in direct connection with the Rathore Group's coordinated departure to Verdana. The exfiltration commenced within days of the initial recruitment overture, escalated as additional team members were recruited and signed offer letters, and ceased only when the departure was imminent. This pattern is inconsistent with any innocent explanation for the data downloads and points instead to a deliberate, coordinated scheme to extract CRH's most valuable competitive intelligence in advance of a group departure to a direct competitor.
VII. Implications for Litigation
A. Breach of Confidentiality Obligations
Each departing employee's employment agreement with CRH contains perpetual confidentiality obligations that survive the termination of employment. These obligations broadly prohibit the unauthorized removal, copying, retention, or disclosure of CRH confidential information, which is defined in each agreement to include trade secrets, business strategies, vendor relationships, pricing information, customer data, and other proprietary business information. The Rathore Agreement, for example, defines "Confidential Information" to include "all information relating to the Company's business, operations, strategies, products, services, vendors, customers, financial condition, and technology" that is not generally known to the public, and it prohibits Rathore from "removing, copying, or transmitting any Confidential Information from the Company's systems or premises for any purpose other than the performance of [her] duties."
Pinnacle's forensic findings establish that all eight departing employees downloaded CRH proprietary data from CRH systems to personal cloud storage accounts — and, in three cases, to external USB devices — during the period when they were actively planning and executing their departure to a direct competitor. This conduct constitutes a clear and unambiguous violation of the confidentiality obligations in each employee's employment agreement. The files downloaded encompass the full spectrum of information covered by the confidentiality definitions in the employment agreements, including strategic plans, vendor negotiation data, private-label cost models, customer analytics, and operational documents.
B. Misappropriation of Trade Secrets Under DUTSA
The exfiltrated materials are strong candidates for protection as trade secrets under the Delaware Uniform Trade Secrets Act, 6 Del. C. § 2001 et seq. ("DUTSA"). DUTSA defines a "trade secret" as information that derives independent economic value from not being generally known to or readily ascertainable by persons who can obtain economic value from its disclosure or use, and that is the subject of reasonable efforts to maintain its secrecy. CRH maintains robust information security measures, including access controls, password protection, network security, and employee confidentiality agreements, that satisfy the "reasonable efforts" requirement.
The following categories of exfiltrated materials are particularly strong trade secret candidates:
• Project Ridgeline documents — representing CRH's five-year strategic plan, which derives substantial independent economic value from its confidentiality and which was developed at significant cost over a fourteen-month period;
• Vendor negotiation term sheets — containing CRH's proprietary negotiation strategies and confidential commercial terms that are not publicly available;
• Private-label cost models — detailing CRH's proprietary sourcing economics and margin targets, which represent core competitive intelligence; and
• Seasonal buying algorithms — embodying proprietary analytical models developed over multiple years and constituting a key component of CRH's operational competitive advantage.
Pinnacle's findings provide concrete evidence of the "acquisition by improper means" element required under DUTSA, 6 Del. C. § 2001(1). The unauthorized downloading of CRH files to personal cloud storage accounts and external USB devices, in violation of CRH's Information Security Policy and each employee's contractual confidentiality obligations, constitutes acquisition through breach of a duty to maintain secrecy. To the extent the exfiltrated materials have been made available to Verdana — a fact that remains to be established through discovery — the "use or disclosure" elements of a DUTSA claim would also be satisfied.
A separate, more detailed analysis of DUTSA trade secret classification for each category of exfiltrated material is set forth in the Project Ridgeline Trade Secret Classification Analysis memorandum dated March 2, 2025, which should be read in conjunction with this memorandum.
C. Tortious Interference and Civil Conspiracy
The timing of the data exfiltration, commencing just four days after the January 6, 2025 Dietrich/Westbrook/Rathore recruitment dinner, supports claims of tortious interference with contractual relations against Verdana. If Verdana or its agents encouraged, directed, or facilitated the Rathore Group's extraction of CRH confidential information, Verdana may be liable for tortious interference with the employment agreements' confidentiality provisions. The extraordinary compensation packages offered by Verdana — including aggregate sign-on bonuses of $6,200,000 and equity grants — further support the inference that Verdana anticipated receiving substantial competitive value from the departing employees beyond their labor and expertise alone.
The coordinated nature of the data exfiltration also supports a civil conspiracy claim against all defendants. The Pinnacle findings demonstrate that each member of the Rathore Group systematically collected materials from their functional area of responsibility during a concentrated twenty-six-day window, using the same methodology, and in temporal coordination with each other. This pattern of parallel, functionally partitioned data collection suggests an organized plan rather than individual, opportunistic behavior by separate employees acting independently. The encrypted messaging exchanges among the Rathore Group during the January 13–24, 2025 period further support the existence of a coordinated agreement to misappropriate CRH data.
D. Support for TRO / Preliminary Injunction
Pinnacle's forensic findings provide strong evidentiary support for CRH's anticipated motion for a temporary restraining order and preliminary injunction in the Delaware Court of Chancery, C.A. No. 2025-0198-MTZ. The findings are relevant to the key elements of a TRO and preliminary injunction analysis as follows:
Likelihood of Success on the Merits. The forensic evidence establishes a strong factual foundation for CRH's claims of breach of contract (confidentiality obligations), trade secret misappropriation under DUTSA, tortious interference, and civil conspiracy. The data exfiltration is clearly documented through system access logs, browser history, USB connection logs, and device forensic imaging.
Irreparable Harm. The data exfiltration demonstrates irreparable harm of the most concrete and immediate kind. CRH's most sensitive competitive intelligence — including its five-year strategic plan, vendor negotiation terms, private-label cost models, customer segmentation data, and seasonal buying algorithms — is now in the possession of employees who have joined a direct competitor that has specifically and publicly targeted CRH's strongest product categories for expansion. The harm resulting from the disclosure or use of this information by Verdana cannot be adequately remedied by monetary damages alone, as the competitive advantage lost through disclosure of trade secrets is inherently difficult to quantify and, once lost, cannot be restored.
Balance of Equities. The balance of equities favors CRH, as the requested relief — return or destruction of exfiltrated data, enforcement of restrictive covenants, and a forensic audit of Verdana's systems — would merely require the defendants to comply with their pre-existing contractual and legal obligations.
Public Interest. The public interest favors the enforcement of contractual obligations, the protection of trade secrets, and the deterrence of coordinated data theft by departing employees.
Dr. Rajiv Anand has indicated his willingness to provide a sworn declaration attesting to the Pinnacle forensic findings in support of CRH's TRO application. The declaration should be drafted in coordination with Pinnacle and should include a detailed description of Dr. Anand's qualifications, the methodology employed in the forensic investigation, and the key findings summarized in this memorandum.
VIII. Outstanding Items and Next Steps
The following items remain outstanding and require attention in the near term:
Pinnacle Supplemental Report. Pinnacle's final supplemental report is expected by approximately March 10, 2025, and will include the following additional analyses:
(a) Hash-Value Analysis. Detailed hash-value analysis of specific high-sensitivity files to establish file integrity and confirm that the exfiltrated files are exact copies of the CRH originals. Hash-value verification will be critical for evidentiary purposes in establishing that the files in the defendants' possession are identical to CRH's proprietary originals.
(b) USB Device Data Recovery. Attempted recovery and analysis of data from the three identified USB external storage devices (those connected to the Halvorsen, Tsao, and Johansson devices), if and when those devices can be obtained through discovery or court order. Pinnacle has the device identifiers from the USB connection logs and can match recovered devices to the forensic records.
(c) Non-CRH Device Access Analysis. Analysis of any additional access to CRH cloud environments from non-CRH devices using CRH credentials, including personal laptops, personal mobile devices, or other devices not returned to CRH. This analysis will be based on IP address and device fingerprint data in the CRH access logs and may reveal additional exfiltration pathways beyond those documented in the Preliminary Report.
Declaration of Dr. Rajiv Anand. It is recommended that Pinnacle's forensic findings be incorporated into a sworn Declaration of Dr. Rajiv Anand to be filed in support of CRH's TRO motion in the Delaware Court of Chancery. The declaration should be prepared in coordination with Pinnacle and should be finalized promptly upon receipt of the supplemental report, or sooner if the litigation timetable requires.
Economic Damages Quantification. CRH has engaged Veltrano Consulting Group LLC ("Veltrano"), under the direction of Dr. Franklin Oberg, effective March 3, 2025, to develop an economic damages quantification model for the data exfiltration and trade secret misappropriation. The Pinnacle forensic findings should be shared with Veltrano (subject to appropriate privilege protections) to enable Veltrano to incorporate the scope and nature of the exfiltrated data into its damages analysis.
Injunctive Relief Considerations. It is recommended that CRH's TRO and preliminary injunction motion include a request for the following specific relief:
(a) An order compelling each member of the Rathore Group and Verdana Commerce Group, Inc. to immediately return or destroy all copies of CRH data in their possession, custody, or control, including data stored on personal cloud storage accounts, personal devices, and external storage media;
(b) An order compelling Verdana to submit to an independent forensic audit of its systems, to be conducted by a court-appointed or mutually agreed forensic examiner, to determine whether CRH data has been uploaded, accessed, or integrated into Verdana's systems; and
(c) An order enforcing the restrictive covenant provisions in each departing employee's employment agreement, including non-competition and non-solicitation obligations, pending further proceedings.
Chain of Custody Preservation. All chain-of-custody documentation for the forensically imaged CRH-issued devices and the CRH cloud environment access logs must be preserved and maintained in the matter file. Pinnacle has confirmed that its chain-of-custody protocols are consistent with the requirements of the Federal Rules of Evidence and Delaware Rules of Evidence, and that all forensic images and associated documentation are maintained in Pinnacle's secure evidence repository.
IX. Attachments (Referenced but Not Reproduced)
The following documents are referenced in this memorandum but are not reproduced herein. All attachments are maintained in the privileged and confidential matter file, 1038-00006.
Attachment 1: Pinnacle Forensics LLC Preliminary Forensic Report (dated February 28, 2025). Privileged and confidential; prepared at the direction of counsel in anticipation of litigation. Maintained in the C&H matter file.
Attachment 2: Summary Table of Exfiltrated Files by Employee, Date, Source System, and Data Category. Prepared by Pinnacle Forensics LLC as an appendix to the Preliminary Forensic Report. This table provides a line-by-line breakdown of file-level exfiltration activity attributable to each departing employee.
Attachment 3: Access Log Excerpts (Aldermere Systems and Pinnacle Health IT) for January 10 – February 4, 2025. Produced by Pinnacle Forensics LLC from CRH's cloud environment access log data. These excerpts document the specific download events, timestamps, user credentials, source file paths, and destination indicators for the exfiltration activity described in this memorandum.
Attachment 4: Device Imaging Chain of Custody Records. These records document the transfer of CRH-issued devices from CRH's IT department to Pinnacle Forensics, the forensic imaging process, and the current location and

Record

Parties

Dates

Amounts