Lost or stolen company laptop: what to do first
A practical order of steps for owners and office managers: cut off access, decide on a remote wipe, check encryption, report it and get the employee working.
An employee calls: their work laptop was taken from the car, or left on a plane, or simply cannot be found. The hardware is the smallest part of the problem. What matters is what the laptop can still reach, what data is on it, and how quickly the person can get back to work. This is a practical sequence for the owner or office manager, roughly in the order things should happen.
The first few minutes: get the facts
Ask the employee, calmly, while details are fresh:
- When and where did they last have it? Is it definitely lost, or could it be at home or in the office?
- Was it shut down, asleep, or open and signed in?
- Which accounts were signed in: email, Microsoft 365 or Google, banking, the accounting system, a password manager, the VPN?
- Were any passwords saved in the browser or written down in the bag?
- What kind of data was on it: client files, health or financial records, employee information?
- Was anything else taken with it, such as a phone, a security key or ID badge?
Look up the make, model and serial number in your asset list. You will need them for the police report and the insurer.
The first hour: cut off access
- Try to locate and lock it. If the laptop is enrolled in device management, or Find My (Mac) or Find my device (Windows) is turned on, check its last known location and lock it with a message showing a phone number. Do not go to recover a stolen device yourself; give the location to the police.
- Change the user's password and sign them out everywhere. In Microsoft 365 or Google Workspace, reset the password and revoke active sessions, so the laptop's existing sign-ins stop working. Do the same for any other business system the laptop was signed into.
- Remove the device from their account, along with any saved MFA methods tied to it, and revoke any VPN certificate or remote access the machine had.
- Change shared credentials stored on the laptop: Wi-Fi keys, shared admin passwords, passwords saved in the browser for business sites.
- Watch the account. Look at recent sign-ins and new mailbox rules over the following days. A forwarding rule nobody created is a sign someone got in before you acted.
Decide whether to wipe
A remote wipe erases the laptop the next time it connects to the internet. It protects the data but usually ends any chance of tracking it. If the device is encrypted and locked, there is often time to wait a day or two for location reports. If it was unencrypted, or held sensitive data, wipe it as soon as you can. Either way, write down when and why you decided.
Was it encrypted?
This is the question that matters most afterwards. If BitLocker (Windows) or FileVault (Mac) was on, and the laptop was shut down or locked, the data on the drive is very hard to read without the password or recovery key. If the disk was not encrypted, anyone who removes the drive can read it. Check your device management console, or the place where recovery keys are stored, to confirm rather than assume. Encryption status is often central to whether a lost device becomes a reportable data breach.
Report it
- Police: file a report for a theft and keep the report number. Insurers usually ask for it.
- Insurance: tell your business insurer and, if you have one, your cyber insurer promptly. Some cyber policies require early notice and provide a breach hotline.
- Data breach obligations: if the laptop held personal information about customers or employees and may not have been protected, state breach notification laws may apply, and some industries have their own rules. Requirements vary by state and situation, so speak to your attorney or your insurer's breach team before concluding nothing needs to be done.
- Clients: if their confidential files were on the device, your contracts may require you to tell them.
Get the employee working again
A spare laptop, set up and enrolled in advance, is the fastest route. If the employee's work lives in OneDrive, SharePoint, Google Drive or a backed-up file server, it can be back on a new machine within hours. If files were saved only on the lost laptop, recovery depends on whether a backup of that device existed. That gap is worth fixing for everyone else afterwards.
If it turns up
Treat a recovered laptop as untrusted until it has been checked. Someone may have had it for days. Back up anything needed, then wipe and reinstall it before it goes back into use. If it is damaged, for example from being dropped, our laptop repair team can assess it.
Make the next one less painful
- Encryption on every laptop, with recovery keys stored by the business.
- Device management so you can locate, lock and wipe.
- Work saved to backed-up locations, not just the desktop.
- An asset list with serial numbers and who has what.
- A one-page version of these steps that managers can find.
Our earlier guide on what to do when a staff laptop dies covers the hardware-failure version of this problem, and our data loss prevention page explains how we help businesses protect their data. If a company laptop has just gone missing, call (213) 986-4855.