Not enough information to go on;
Not much help I can provide; unless could confirm similar tools sources I may have be familar with.
I recommend to approach the issue internally with these thoughts, unless can get some specifics tools / sources that are available that would potentially have the evidence.
To that point:
Do you have a tools in your environment and/or the necessary logging to generate an event;
1. Any DLP tools that detect (transfer files to/from endpoint to cloud storage, usb, etc)?
2. Any Proxy servers or other that can detect, and on track usage by user.
3. Email logging
4. Splunk UF on the endpoints
5. Host base firewall on endpoint.
My thoughts;
1. Any DLP solution exist you, maybe configured to alert; and probably not asking this.
2. If you don't know the in's and outs of what data you have or where to look and the individual is gone and you have the device; digital media analysis/forensics is on option.
3. If you have email logs then looks for anything from sender and not to agency with large file.
4. If Splunk Logging of endpoint with UF and depending on the level of logging. I would analyze for dns logs / ip as to connections to cloud sources.
