The first useful question after a theft is not where the laptop went. It is what was on it, and when it last backed up.
A stolen work laptop is two problems at once. One is access: the laptop is signed in to email, files and apps, and someone else now holds it. The other is work: a person has lost their tools and possibly their latest files. Handle them in that order. Access first, in minutes. Work second, in hours. Records third, over the week.
The first hour: close the doors
The laptop itself is gone. The accounts on it are the part you can still control.
- Tell whoever runs IT, now. Do not wait for a police report or for the person to search the car again.
- Sign the user out everywhere. In Microsoft 365 or Google Workspace, an admin can end every active session and reset the password. This stops a signed-in browser on the stolen laptop from staying signed in.
- Check two-factor methods. If a phone was taken with the laptop, remove it as a sign-in method.
- Lock or wipe the device remotely, if your laptops are enrolled in device management.
- Change other access. VPN or remote access credentials and any passwords saved in the laptop’s browser should be changed.
- Check disk encryption. Find out whether full-disk encryption (BitLocker on Windows, FileVault on a Mac) was switched on. If it was, and the laptop was shut down or locked, the files are much harder to read. If it was not, assume they can be read.
- Report it to the police, for the record and for insurance.
These are the same account steps that sit near the top of the ransomware recovery checklist. It is worth having them written down before you need them.
The first day: back to work
Once access is closed, the question becomes how much work is missing.
Start with the time of the last completed backup. With the Workstation Backup plan, a laptop copies file changes every hour it is online, over any internet connection, so the gap is usually the time since it was last online. The backup console shows the exact time.
Then get a replacement machine: a spare, a loaner or a new one. Our target for restoring a lost or stolen laptop’s files to a new machine is within 1 business day. The person signs in to their cloud apps, their files arrive, and they pick up where the last backup left off. Because the plan keeps 90 days of versions, an earlier copy of any file can come back too, which helps when the newest version turns out to be a half-finished draft.
Be clear about what does not come back:
- Work after the last backup. Anything saved after the laptop was last online.
- Files outside the backed-up folders. A folder made at the root of the drive, for example, if nobody added it.
- The exact setup. Workstation backup copies files, not a full-disk image, unless you asked for one. Programs are reinstalled from a standard build.
For most people that is a short list, and much of it can be rebuilt from sent email.
The first week: record what left
This step is easy to skip and important to do. You need to know what data left the building.
Here the backup does a second job. Its file listing shows exactly what was on the laptop at the last backup: which client folders, which spreadsheets, which exports. That turns a vague worry into a concrete list.
Be honest about what the listing does not show. It covers the folders that were backed up. It does not show a cached copy of the mailbox, which most email apps keep on the laptop for offline use. It does not show browser downloads that were cleared, or files saved outside the backed-up folders. Add those to the list as “possibly present,” so nobody reads the listing as the whole story.
With that list, talk to your insurer and to your counsel. Whether a stolen laptop creates a duty to notify anyone depends on your state, the kind of data and whether it was encrypted. That is a legal question, and your counsel decides it. Our part is to help you produce the facts quickly.
Finally, look at how it happened without looking for someone to blame. Was the laptop left in a car because there was nowhere safe to put it during a site visit? Fix the routine, not the person.
Example: a recruiter’s laptop taken from a car
Take a 40-person staffing agency. A recruiter stops at a grocery store on the way home on a Wednesday, and at 6:15 p.m. the laptop is taken from the back seat. It was last online at 5:40 p.m., from a coffee shop.
- 6:30 p.m. The recruiter emails the office manager, who handles IT for the agency.
- 6:45 p.m. The office manager signs the recruiter out of every Microsoft 365 session, resets the password and removes the laptop’s saved sign-in. Device management shows full-disk encryption was on.
- 8:30 a.m., Thursday. The office manager emails support@ezbre.com asking for a restore to a spare laptop. We confirm the last completed backup ran at 5:12 p.m. the evening before.
- Thursday afternoon. The spare is set up, the recruiter’s files are restored, and the recruiter is working again. The 28 minutes of edits between 5:12 and 5:40 p.m. are rebuilt from sent email.
- Friday. The backup’s file listing shows the laptop held candidate résumés with personal details. The agency sends that list to its insurer and counsel, noting the encryption status.
Two things made this a short week rather than a long one. The accounts were closed within half an hour, and the backup ran from wherever the laptop was, not only at the office.
Agree who does what
Many offices have no IT staff, so it helps to agree the roles before anything goes missing:
| Task | Who usually does it |
|---|---|
| Signing the user out and resetting passwords | Whoever holds the Microsoft 365 or Google Workspace admin account |
| Remote lock or wipe | Your IT person or outside IT provider |
| Finding the last backup and restoring files | Your backup provider |
| Setting up the replacement laptop | Your IT person or provider |
| Insurer, counsel and the police report | The owner or office manager |
Write the names beside each line, with a deputy for each, and keep the list somewhere other than the laptops.
If the laptop turns up again
Sometimes a lost laptop is handed in, or the police recover it. Do not plug it back into the office network or sign in to it. You cannot know what was done to it while it was gone.
Treat it as untrusted. Wipe it, reinstall the operating system from a known source, and set it up as if it were new. The files on it are already restored elsewhere, so nothing is lost by erasing it.
Before the next one
Laptops go missing often enough that it is worth preparing once. Check these now:
- Full-disk encryption is on for every laptop, and you have checked, not assumed.
- Backups cover the desktop, documents, downloads and any app data folders people use.
- Backups run over home and public connections, not only the office network.
- Someone can sign a user out of everything within 15 minutes, using written steps.
- Laptops are enrolled in device management, so they can be locked remotely.
- There is a spare laptop, or a supplier who can deliver one within a day.
- You know who to tell: IT, your insurer, your counsel.
Fast data recovery covers restores for laptops, servers and cloud apps, with targets we test every quarter.
A calm next step
If you are not sure when your laptops last backed up, that is quick to find out. The free backup check is 45 minutes, remote, with one test restore and a written page of findings. You can book a free backup check and we will start with the laptops.
