Catalyx suspects the security breach — which resulted in undisclosed losses — may have involved one of its own employees.