Sophisticated insider threat window active between 14–19 Apr 2026. NSW Treasury employee arrested by NSW Police on 20 Apr 2026. Over 5,600 confidential commercial, policy, and financial state documents were exfiltrated to an unauthorized external server. Strike Force Civic established; all data reported recovered.