You could use a Canary / beacon. I have used this before to detect/confirm insider threats in organizations. You could create a PDF with instruction on how to view the data inside the SD. When the attacker opens the document, it would send an alert that the document has been opened.
https://canarytokens.org/generate