What To Do About A Stolen Work Laptop, In The First Hour
The device matters less than the accounts on it. Here is the order to do things in.
In short: a stolen work laptop is an account problem before it is a hardware problem. Call 678-374-4352 immediately so sessions can be revoked, and report a stolen work laptop even if you think it will turn up.
A stolen work laptop is a hardware loss and a security incident, and only one of those is expensive. The laptop can be replaced by Friday. The signed-in accounts are the problem.
Do these things in this order and the incident usually ends as an insurance claim rather than a breach.
Call Us Before You Call Anyone Else
Call 678-374-4352 and say a device is missing. That starts the clock on the things only we can do: signing the device out of accounts, revoking sessions and, where the device supports it, wiping it remotely.
Tell us the person, roughly when it went missing, and whether it was locked at the time. All three change what we do next.
Call even if it is the middle of the night; 678-374-4352, option 1, exists for this and is never unstaffed.
Change The Passwords That Were Signed In
Email first, because email is the master key that resets everything else. Then anything financial. Then everything else.
Change them from a different device. If the laptop is compromised rather than simply gone, typing a new password on it hands the new one over too.
Multi-factor authentication is what buys you the time to do all of this calmly. If it was not on before, it goes on now.
Then Do The Paperwork
Report it to the police and get a reference number. Insurers ask, and so does anybody who later wants to know that you took it seriously.
Tell whoever owns risk in your business. If regulated data was on the device, there may be a notification obligation with a deadline attached.
Write down what was on it as best you can while it is fresh. That list is what everything afterwards is judged against.
What Else Was In The Bag
Laptops rarely go missing alone. A car break-in usually takes the whole bag, and the bag often holds a work phone with the authenticator app, an office key card, a USB drive or printed client papers.
When you report a stolen work laptop, mention everything that was with it. A key card or a written password can matter as much as the machine itself.
Mistakes After A Laptop Goes Missing
Going to get the laptop yourself after a tracking app shows where it is. A location on a map is information for the police, and no replaceable device is worth confronting a thief. Give the location to the officer handling your report.
Removing the missing device from your Microsoft or Apple account to disconnect it. That can turn off the tracking and lock features that make it useless to whoever has it.
Treating a personal laptop as a private matter when it was used for work. If it held your work email, files or saved passwords, it carries the same risk as a stolen work laptop and needs reporting the same way.
Borrowing a shared family computer for work while you wait for a replacement. Saved passwords and open sessions on that machine create a second exposure on top of the first.
Laptop Situations That Still Need A Call Later
If the laptop turns up after being out of your hands, do not sign in or connect it to the office network until it has been checked. Call 678-374-4352 first, because a returned device may have been tampered with.
Password reset emails you did not request, unfamiliar sign-in alerts, or approval prompts in the days after a stolen work laptop mean someone may still be trying your accounts. Report them on the security line, option 1, which is answered 24/7.
Questions about setting up a replacement can go to the help desk, Monday to Friday, 8 AM to 5 PM Eastern.
Report It Even If You Think It Will Turn Up
Most missing laptops are not stolen. They are in a car trunk, at a client site, or behind a reception desk. That is exactly why people wait, and waiting is the mistake.
The actions we take in the first hour are all reversible. Revoking sessions signs you out and you sign back in. Marking a device as lost can be undone. Changing a password is an inconvenience. None of it is destructive and none of it costs anything if the laptop reappears at lunchtime.
The actions you cannot undo are the ones that happen if a stolen work laptop is in somebody else’s hands for six hours with a live session on it.
So report it when you notice, not when you are certain. Nobody has ever been criticized here for reporting a laptop that turned up.
What We Actually Do When You Call
It helps to know the sequence, because it explains the questions.
First we revoke active sessions on the accounts that device was signed into, which invalidates the tokens that keep somebody logged in without a password. This is the single highest-value action and it takes seconds.
Then we force a password change on those accounts, so any saved credentials in the browser stop working. Then, where the device is managed, we mark it as lost, which can lock it and in some configurations wipe it the next time it touches a network.
Then we look at what the account could reach. Email, file storage, line-of-business systems, anything with saved access. That list is what determines whether this is an inconvenience or something that needs to be disclosed to clients.
The last step is a record of what was done and when, which matters if a regulator or an insurer asks later.
Encryption Is What Decides How Bad This Is
There is one technical fact that separates a stolen work laptop that is a nuisance from one that is a notifiable data breach, and that is whether the disk was encrypted.
On an encrypted disk, the data is unreadable without the credentials. The thief has a machine to sell and nothing else. In most regulatory frameworks this materially changes what you are obliged to report and to whom.
On an unencrypted disk, everything on it is readable by anyone who removes the drive, regardless of how strong your Windows password was.
Encryption is not something you can enable after the laptop is gone, which is the whole point. If you do not know whether your machine is encrypted, that is worth asking today rather than finding out during an incident.
It is standard on the devices we manage, and it is the first thing we check when a device goes missing.
The Habits That Limit The Damage
Four ordinary habits do most of the work, and none of them require you to think about security.
Lock the screen when you walk away, and let the automatic lock timeout stay short. Most opportunistic theft happens from a table in a coffee shop or a parking lot, and an already locked machine is a very different proposition.
Keep working files in cloud storage rather than only on the local disk. Then a stolen work laptop costs you a device rather than a week of work, and there is nothing to reconstruct.
Use multi-factor authentication everywhere. A stolen password is only useful if it is the only thing standing in the way, and MFA is what makes a captured credential worthless.
The last is knowing the number to call without looking it up. 678-374-4352.
Related Guides And What To Have Ready
Related: what to do when you lose the phone with your MFA on it, reporting a security incident, and public WiFi safety for the travel case. More in Security and phishing.
When you call about a stolen work laptop, have ready: when and where you last had it, whether it was locked, which accounts were signed in, and whether client files were stored locally.
Call 678-374-4352 first and the police second. The police report number is useful for insurance but it does not close any doors.
For general guidance on device loss and reporting obligations, see CISA Secure Our World.
A Stolen Work Laptop Checklist
The first hour decides whether a stolen work laptop is an insurance claim or a data breach.
- Call 678-374-4352 before anything else, including the police.
- Say whether it is lost or stolen. A stolen work laptop changes the response.
- Tell us when and where you last had it, and whether it was locked.
- List the accounts that were signed in on it.
- Say whether client files were stored locally or only in the cloud.
- Let us revoke sessions and force password changes on those accounts.
- Change any password you know was saved in the browser.
- Report it to the police for the reference number and the insurer.
- Do not wait to see whether the laptop turns up.
- Afterwards, confirm the device is removed from your MFA registrations.
Every action in the first hour is reversible if the laptop reappears at lunchtime. The damage from waiting is not.
What A Stolen Work Laptop Exposes In Your Industry
The hardware is replaceable everywhere. What sits on it is not.
Law firms. Client files, case references and privileged correspondence. Whether a stolen work laptop is notifiable often turns on one technical fact, which is whether the disk was encrypted, and that cannot be changed after the event.
Distribution and logistics. Customer lists, pricing and margin data. A competitor would find it valuable and a customer would find its loss alarming, which makes the disclosure conversation harder than the replacement cost suggests.
Manufacturing. Drawings, specifications and supplier terms. Intellectual property on a stolen work laptop is the category most often underestimated, because it does not look like personal data and is not covered by the same instincts.
Encryption, a short lock timeout and multi-factor authentication are what decide the outcome. All three are set in advance. Call 678-374-4352.
Questions About A Stolen Work Laptop
It helps a great deal, particularly with disk encryption on. Still call us.
Often, if the device is managed and comes online. That is a reason to call quickly.
Yes, from a different device, starting with email.
Yes, and keep the reference number for the insurer.