It's much more sophisticated than just (a) do you or did you work there and (b) did you make money on a trade.
I work at a law firm that does public M&A deals and we occasionally get inquiries from the SEC about, e.g., people that went to my high school (but a different class year) who bought stock in a company my firm did work for in the months leading up to the deal. Obviously neither me or the other person ever worked at either company (or even had any connection to them), but they still identify us as a potential risk because I could have potentially obtained insider info through the firm and then passed it on.
I work at a law firm that does public M&A deals and we occasionally get inquiries from the SEC about, e.g., people that went to my high school (but a different class year) who bought stock in a company my firm did work for in the months leading up to the deal. Obviously neither me or the other person ever worked at either company (or even had any connection to them), but they still identify us as a potential risk because I could have potentially obtained insider info through the firm and then passed it on.