What to Do When a Business Laptop Is Stolen

The first hour in order, why revoking sessions matters more than remote wipe, how to tell a hardware loss from a data incident, and the prep that decides which it is.

By the founder — infrastructure engineer, 15 years (bio) · Updated 2026-08-11

Two businesses lose an identical laptop on the same day. One files an insurance claim, buys a replacement, and the employee is working again by Thursday. The other spends three weeks establishing whether client data was exposed, notifying people, and answering questions from a customer’s legal team.

Same hardware, same thief. The difference was decided months earlier by three things: whether the disk was encrypted, whether anyone could revoke the device’s sessions, and whether the passwords lived in a manager or in the browser.

If a laptop has just gone missing, start at the top. If you’re reading this while nothing is on fire, skip to what actually decides the outcome — that’s the part worth your time.

The first hour, in this order

The order matters, and it isn’t the order most people reach for. The instinct is to remote-wipe immediately. That’s usually the fourth thing to do, not the first.

Understand what’s actually at risk. A modern stolen laptop is rarely a disk-forensics problem. It’s a logged-in browser. Whoever has it may not need a password for your email, your files, your CRM, or your bank — the session cookies are already there and already authenticated. That is the exposure, and it stays live until you kill it.

1. Revoke every session

Do this before anything else, because it’s the only step that closes the door that’s actually open.

• Google Workspace: Admin console → Directory → Users → the affected user → Security → Sign out. This invalidates existing sessions rather than just requiring a future login.
• Microsoft 365: Entra admin centre → Users → the user → Revoke sessions.
• Everything not behind your identity provider: banking, payroll, your domain registrar, any tool with its own login. Each needs its own sign-out-everywhere action.

2. Reset the account password

After revocation, not before. Reset first and you may issue a fresh valid session to a browser that’s still holding the device.

3. Deal with the second factor

If that laptop held an authenticator app, passkeys, or saved backup codes, your MFA is now partly in someone else’s hands. Enrol a new factor on a device you control and remove the old one. If backup codes were stored on the machine, regenerate them.

4. Now lock the device — and think before wiping

• macOS: iCloud → Find My → Mark As Lost.
• Windows: Microsoft account device page, or Intune if you have it.

Whether to wipe depends on one fact:

The tradeoff is real: a wipe ends any chance of locating the device, and it removes it from your management console, so you lose visibility. On an encrypted machine that’s a bad trade. On an unencrypted one it’s the only option.

Note that both lock and wipe require the device to connect to the internet. Neither is guaranteed to ever execute. Plan as though they won’t.

5. Write down what was on it

While it’s fresh: when it was last in your possession, what accounts were signed in, what was stored locally rather than in cloud storage, whether client files were on the desktop. You will need this for the insurance claim, and possibly for a conversation with a client. Memory degrades fast and this is the cheapest thirty minutes you’ll spend.

Day one

File a police report. Insurers generally require one, and you want the report number recorded on the same day.

Contact your insurer. Two separate questions: the hardware claim on your general policy, and whether your cyber policy is engaged. Many cyber policies have notification deadlines measured in days and some require you to use their approved responders — using your own first can affect coverage. Our cyber-insurance readiness guide covers what to have ready before you need it.

Tell your team what happened. Not for morale reasons — because the person who lost the laptop is now a target for a follow-up. A thief with a work laptop knows where you work, and “IT here, we need to verify your account after the theft” is an easy call to make. Say plainly that nobody will phone them asking for a code.

Is this a data incident?

This is the question that determines whether you’re out a laptop or into a process, and it’s a question for a lawyer, not a checklist.

What’s worth knowing going in: encryption is treated differently under many US state breach-notification statutes, which is a large part of why it matters so much. But the specifics vary by state, by the type of data involved, and by which states your affected individuals live in — not where your business is. Don’t decide this from a blog post, including this one. If client or personal data was on that machine, call counsel.

Your contracts may bite before any statute does. Small service businesses routinely sign client agreements with security and notification clauses, often without reading them closely, and those clauses frequently have shorter deadlines than the law. Before you conclude you have no obligation, read the contracts for the clients whose data was on that laptop. If you’ve ever filled in a client security questionnaire, check what you told them you’d do — our questionnaire guide covers the commitments people make without noticing.

What actually decides the outcome

Five controls. Each one takes minutes to set up and all of them have to exist before the theft, which is the entire point.

Full-disk encryption, on every machine. FileVault on macOS, BitLocker on Windows. It is free, it is built in, and it is the single control that separates “we lost a laptop” from “we lost data.” Verify it’s actually on rather than assuming — check it on every machine today. On Macs it can be enabled at setup and skipped; on Windows, BitLocker availability and default state varies by edition and configuration.

Some way to lock and wipe remotely. At minimum, Find My on Macs and a Microsoft account on Windows machines. This costs nothing. Without it, step 4 above simply isn’t available to you.

Passwords in a manager, not in the browser. This is the one people underestimate. Passwords saved in an unlocked Chrome profile are readable, and they hand over every account at once — including the ones your identity provider can’t revoke. A password manager keeps them behind a vault that locks. It also means you can see what was exposed and rotate deliberately instead of guessing. When our password manager reviews are published we’ll have tested exactly how each one behaves in this scenario; the general principle doesn’t depend on which you choose.

MFA that doesn’t live only on the lost device. Two factors on one device is one factor. Keep a second enrolled elsewhere — a phone, a hardware key — and store backup codes somewhere that isn’t the laptop.

A backup, so the work isn’t the loss. If the only copy of anything was on that disk, the theft costs you the work as well as the hardware. Cloud sync is not the same thing as backup, for reasons covered in cloud storage is not backup.

The twenty-minute version

If you do nothing else after reading this:

1. Verify FileVault or BitLocker is on, on every company machine. Not assumed — checked.
2. Confirm you can locate and lock each one from an account you control.
3. Move any browser-saved passwords into a password manager and clear them from the browser.
4. Check that each person’s MFA has a second factor not on their laptop.
5. Confirm the last successful backup for each machine, by looking at it.

That list is most of the distance between the two businesses at the top of this page. None of it requires a purchase, and all of it stops being possible the moment the laptop is gone.

This guide describes general practice and is not legal advice. Breach-notification obligations depend on your jurisdiction, your contracts, and the data involved — consult a lawyer for your situation. This page contains no affiliate links.