He had the references to get hired at this job, right? So just leave the job you screwed off the resume.

A similar thing happened to a client. Sysadmin logged into GCP and Azure immediately after termination and just deleted everything. He was in the UK, we were in the US. Wasn't worth it to try to get someone to prosecute, and I'm sure we're not listed as references.

Did get people motivated for a multifactor delete bucket for extra backups.