Security firm claims up to 75% of IT staff “steal data”