Your work laptop is gone. Here is what to do before lunch

The first hour decides most of it

If a work laptop has just been lost or stolen, do these things in this order, today: report it to whoever runs your IT, sign the person out of everything and change their password, send a remote lock or wipe to the laptop, file a police report, and then work out whether the drive was encrypted. That last question decides almost everything that follows. An encrypted laptop that goes missing is usually an equipment loss and an insurance claim. An unencrypted one holding customer or employee records may be a data breach with legal notice deadlines attached.

Most people do these steps in the wrong order. They spend the morning retracing their steps through the coffee shop and the parking garage, and they call IT at lunch. To be honest, the laptop itself is the cheap part. A replacement costs a day’s hassle and some money. What you are protecting in that first hour is the email account, the files and the saved passwords that are still sitting on it, signed in.

What to do, step by step

This is the list I would give a client on the phone. It assumes you use Microsoft 365 or Google Workspace and that your laptops are enrolled in some kind of device management. If they are not, you will skip step four and lean harder on step two.

1. Tell IT immediately, with the facts. Whose laptop, when it was last seen, where, whether it was on or asleep, and whether the person had a password manager or saved passwords in the browser. “I think I left it in the Uber at 8:15” is far more useful than “my laptop is gone.”
2. Cut off the account, not just the device. Reset the user’s password and revoke their sessions. In Microsoft Entra ID that is the Revoke sessions button on the user’s page; Google Workspace has a sign-out option for the user in the admin console. Microsoft notes that access tokens already issued normally last an hour, so some apps can keep working for up to that long after you revoke. That is the reason to do this first, not last.
3. Change anything the laptop could open on its own. Banking, payroll, the domain registrar, any admin account the person used. If passwords were saved in the browser, assume they are known.
4. Send the lock or wipe. Intune, Jamf, Google endpoint management and similar tools can lock or reset a managed laptop remotely. The catch is that the command only runs when the laptop next connects to the internet. A thief who keeps it offline still has whatever is on the disk, which is why encryption matters more than the wipe button.
5. Report it to the police and get a report number. Your insurer will ask for it, and so will any later breach analysis.
6. Check the encryption status and write it down. Your device management console usually shows whether BitLocker (Windows) or FileVault (Mac) was on, and it holds the recovery key. Screenshot it with the date. That screenshot may turn out to be the most valuable thing you produce all day.
7. List what was on it. Synced folders, downloaded spreadsheets, client files, anything with Social Security numbers, health information, card numbers or bank details.
8. Call your cyber insurer before you call anyone else outside the company. Many policies want to be told early and want you to use their breach counsel.

If your team has never practiced this, put it in a one-page incident plan. Our incident response plan template has a section for exactly this case.

Encryption is the deciding factor

Here is my opinion, stated plainly. An encrypted laptop is an equipment loss. An unencrypted laptop may be a breach notice. The steps above matter, but that one fact decides how the next month goes.

The premise of breach notification laws is that people deserve to know when someone else may have their personal information. The catch, for the business, is that most of those laws define “personal information” in a way that leaves encrypted data out. Florida is a good example. Section 501.171 of the Florida Statutes excludes information that is “encrypted, secured, or modified by any other method” that makes it unusable, and where notice is required it must go to affected people no later than 30 days after the business determines there was a breach (or has reason to believe one occurred). If 500 or more Florida residents are affected, the state Department of Legal Affairs has to be told as well. Georgia, Alabama and Tennessee have their own versions, and they differ in the details. We have written up Florida’s breach notification law separately.

Health information follows a similar pattern under HIPAA. HHS treats protected health information that has been encrypted to its guidance as “secured,” and the breach notification rule applies to unsecured information. A medical practice that loses an encrypted laptop is in a very different position from one that loses an unencrypted one.

Two cautions. Encryption only helps if the key was not with the laptop. A recovery key on a sticky note in the laptop bag, or a laptop that was stolen while signed in and awake, may not count. And none of this is legal advice. It is general information about how these laws tend to work. Whether your particular loss needs a notice is a question for your attorney and your insurer, and you want to ask it early, because the clock in most states starts when you determine there was a breach.

A worked example

Picture a 30-person accounting firm. On a Monday in tax season, a staff accountant’s laptop is taken from a car. It holds a synced folder with about 400 client returns, which include names, Social Security numbers and bank account details.

In version A, the firm’s laptops are managed and BitLocker is enforced by policy. IT revokes the accountant’s sessions within twenty minutes, sends a wipe, and pulls a console screenshot showing the drive was encrypted with the key held in Entra ID. The firm files a police report, tells its insurer, and its attorney concludes that no notice is needed. The cost is a new laptop and a lost afternoon.

In version B, nobody ever turned encryption on. The same 400 clients now probably need letters, the firm may owe notice to state regulators depending on where those clients live, and the insurer gets involved in forensics and credit monitoring. Same laptop, same thief. The difference was one setting turned on, possibly years earlier.

What to set up before it happens

If you read this before anything has gone missing, you are in the best position there is. The fixes are mostly boring and mostly one-time.

• Turn on full-disk encryption on every laptop through a policy, not by asking people. BitLocker and FileVault are built in.
• Enroll laptops in device management so you can see encryption status, hold the recovery keys centrally and send a lock or wipe. Our guide to mobile device management for small business covers the options.
• Require MFA on email and every cloud app, so a stolen laptop with saved passwords still cannot sign in from somewhere new.
• Keep files in OneDrive, SharePoint or Google Drive rather than only on the laptop, so a wipe does not destroy the only copy.
• Keep an asset list: who has which laptop, its serial number and its encryption status.
• Write the steps above on one page and make sure staff know to call within the hour.

Most of this overlaps with what you already need when someone leaves the company. Our employee offboarding checklist uses the same controls.

Not sure whether every laptop in your office is encrypted right now? That is one of the things our free Technology Health Assessment checks. It takes 30 minutes of data collection, and you get a plain-language report the next day that is yours to keep. Book your free assessment.

Where we fit

Through our cybersecurity service we turn on encryption by policy, enroll devices, hold recovery keys, and help you answer the “was it encrypted?” question with evidence when a laptop does go missing. We are not your lawyers, and we will tell you when it is time to call them. In my experience, the firms that get through a lost laptop calmly are the ones that never had to search for the recovery key.

Related services

• Cybersecurity services
• Free Technology Health Assessment
• Florida data breach notification law
• Mobile device management for small business