One simple trick to make it easier to determine the source is to embed a couple of sentinel records into your DB. That way if it does get leaked you are sure that you were the source and if another party is the source you will know this because your sentinels will not be present. This helps to strengthen the claim that the data was not leaked through your company (it is not a guarantee, after all it could be an inside job with the sentinels stripped but the chances are somewhat reduced).