How did they able to figured this out?
"Apparently, the Chinese national began exfiltrating files in May 2022, sending them to a personal Google Cloud account. Google's protection policy enforcers would have noticed this earlier if it wasn't for Ding "copying data from the Google source files...