Laptop lost or stolen: what now?

Has your work laptop been lost or stolen? Act quickly. In this article, you will read what you must do immediately, how FLEXAMIT can remotely secure or wipe a managed laptop, and why company data should never be stored exclusively on your laptop.

Important: report a lost or stolen work laptop immediately to your IT administrator. Do not wait several hours or days to see if the device might be found.

What should you do immediately?

Report the device immediately.
Provide as much information as possible:
- which laptop was lost or stolen;
- when you last saw the device;
- where it was presumably lost or stolen;
- whether the laptop was turned on or unlocked;
- whether someone may know your PIN code or password;
- whether you suspect someone has had access to the device.
Is the device stolen? If necessary, also file a report with the police.
Follow the instructions of your IT administrator for any additional security measures.

Reporting quickly makes a big difference.
The sooner IT knows a device is missing, the sooner access, sessions and the device itself can be checked.

Is your laptop managed by FLEXAMIT?

When your laptop is centrally managed by FLEXAMIT, we have additional options to intervene in case of loss or theft.

Depending on the device and configuration, we can for example:

identify the device in our management environment;
check the security status;
assess Microsoft 365 access and active sessions;
remove company data and device configuration;
wipe the device completely remotely;
perform other available remote security actions.

FLEXAMIT can remotely wipe a managed laptop.

When the situation requires it, we can perform a remote wipe on supported and properly managed devices.

This instructs the device to delete company data and, depending on the chosen action, the entire local installation.

How does a remote wipe work?

For centrally managed devices, the IT management environment can send a command to the laptop to wipe the device.

The goal is simple:

device missing → restrict access → delete data remotely

A remote wipe is especially useful when there is a real risk that unauthorized persons can access the device.

Important limitation:
a remote wipe must be able to reach the device. If a stolen laptop never connects to the internet again, a new command may not be executed.

Therefore, remote wipe should never be the only security measure.

BitLocker protects your data even if the laptop stays offline

A professionally managed Windows laptop should be equipped with BitLocker disk encryption.

This encrypts the data on the internal drive. Someone who removes the SSD from the laptop or tries to read the device outside of Windows cannot simply access the data.

Remote wipe and BitLocker complement each other.
BitLocker immediately protects local data. Remote wipe gives IT an additional option once the device is reachable again.

Can a laptop also be located?

Depending on the type of device and chosen security solution, there are laptops with additional tracking or location functionality.

Such devices can use integrated technology that, depending on available connection and service, can locate a lost or stolen laptop.

FLEXAMIT can also review which devices and solutions are suitable for organisations where this is important.

Tracking is an additional security layer, not a guarantee.
A device can be switched off, have no connection, or be in a location where localisation is not possible. Your security strategy should therefore never rely solely on the ability to find the laptop.

The most important: store your company data in the cloud

The best situation is not that a lost laptop can always be found.

The best situation is that you can continue working without that laptop.

Company documents should therefore be stored as centrally as possible, for example in:

OneDrive;
SharePoint;
Teams;
another professionally managed cloud solution.

Your laptop should never be the only place where important company data exists.

If a laptop is stolen, broken or completely wiped, you should in principle be able to take a replacement device, log in again and access or synchronise your files again from the cloud.

The device is replaceable. Your company data should not be.

Why local storage is a risk

Storing files exclusively in, for example:

Documents;
Downloads;
a local folder on C:;
the desktop when it is not synchronised with OneDrive

can mean those files exist only on that one device.

In case of:

theft;
hardware failure;
loss;
ransomware;
a necessary remote wipe

such files can be lost if no other copy exists.

A remote wipe protects your organisation but also deletes local data.
That is exactly why important company files must be stored centrally beforehand.

What is the ideal scenario then?

A well-managed modern work laptop conceptually looks like this:

Microsoft Intune or other central tooling manages the device;
BitLocker encrypts the local drive;
Windows Hello protects local login;
MFA or passkeys protect cloud accounts;
endpoint security protects against malware and attacks;
Conditional Access controls access to company services;
OneDrive and SharePoint store company data centrally;
IT has appropriate remote management actions for loss or theft.

This way, the laptop increasingly becomes an access device to your workplace instead of the only place where your work exists.

Is a stolen laptop automatically a data breach?

Not necessarily.

Among other things, it must be assessed:

whether the device was encrypted;
whether the device was locked;
which data was locally present;
whether someone possibly had access;
which accounts were active on the device;
which security measures were active.

Therefore, a lost or stolen company device must always be reported. Your IT administrator can then help assess which technical and possibly organisational steps are necessary.

Do I have to change my Microsoft 365 password?

Not automatically in every situation.

The risk is greater when:

the laptop was unlocked;
someone knows your Windows PIN or password;
passwords were stored unsecured locally;
the laptop was not professionally managed;
the drive was not encrypted;
you see suspicious account activity.

IT can also decide to:

revoke active Microsoft 365 sessions;
monitor sign-ins;
check MFA methods;
require a password change;
take additional access measures.

What if I find my laptop again?

Do not automatically use a found company laptop again.

First report to your IT administrator that the device has been found.

Depending on the circumstances, it may be necessary to:

check the device;
check whether it has been tampered with;
put the device back under company management;
reinstall it completely;
reconfigure accounts and security data.

A found device is not automatically a trusted device again.

Prevention is more important than reaction

The best security is set up before a laptop disappears.

For modern company laptops, we therefore expect at least attention for:

central device management;
BitLocker;
Windows Hello;
strong MFA or passkeys;
endpoint protection and EDR;
Conditional Access;
automatic security updates;
central storage of company data;
remote management and wipe functionality;
a clear procedure for lost and stolen devices.

A stolen laptop does not have to be an IT disaster.

FLEXAMIT manages company laptops so that multiple security layers work together: device management, encryption, endpoint security, Microsoft 365 security, cloud storage and remote management.

For organisations where the risk of theft is particularly important, we can also review which laptops or additional tracking solutions are suitable to locate lost or stolen devices.

Would you like to know how well the laptops in your organisation are protected today?

Contact:

sales@flexamit.com