This was not just from a thumb drive as that is very tightly controlled at TSMC (they did catch someone right away before it got leaked). The employees were caught printing info and removing it from the company (caught due to magnetic ink setting off the metal detectors) as well as using phones to take pictures of their laptop info while connecting from offsite. Taking pictures of remote laptops is a more covert way, but both employees were caught through suspicious pattern analysis and review of access logs of people right before they quit the company.