A laptop was stolen: what to do in the first hour

The laptop is the cheapest part of the loss. The expensive part is everything it could still open when it left the building: the mailbox, the passwords the browser remembered, the supplier portal, the spreadsheet that existed nowhere else. Assume the disk will be read by someone else, and work in that order — cut access, change what is left, then rebuild. The one measure that changes the outcome was decided earlier: whether the disk was encrypted while the machine was shut down.

What does a work laptop hold that nobody writes down?

More than its documents. It carries live sessions and stored credentials that outlive the hardware, and most are invisible in a file browser.

• Browser sessions. Being signed in is a cookie, not a password. It keeps working on a machine now in someone else's hands, and does not expire because the laptop moved.
• Saved passwords and autofill. The mail account, the hosting panel, the bank, the marketplace back office. A browser that fills a login without asking is a keyring that travelled with the machine.
• The file that only exists there. A price list, a customer export, a sheet kept on the desktop "until we decide where it goes". This one cannot be revoked, only rebuilt.
• The downloads folder. Signed contracts that were printed and scanned, a customer's ID photo, a bank statement saved as PDF.
• Mail client credentials. A configured mail application keeps the password it was given, and a copy of the mailbox on the disk.
• Remote access. A VPN profile, a remote desktop shortcut, an internal tool opened with one shared password, a saved session on the accounting system.

Why is the mailbox the first call and not the files?

Because mail is the reset channel for everything else. Whoever reads a mailbox can ask most of the accounts registered to that address for a password reset, and read the message that follows. A copied file is a document; a live mailbox is a set of keys, and it keeps producing new ones.

A password change alone does not close it. The OWASP Authentication Cheat Sheet treats session handling as part of authentication: a session that survives a password change is an authentication failure.

What is the order in the first hour?

Order matters: each step protects the next, and the machine you will buy can wait.

1. Revoke the mail sessions, then change the mail password. Find the control that signs out every device, not only the one in front of you.
2. Turn on two-step verification on that mailbox, and check the recovery address and phone number are ones you still control.
3. Revoke app passwords and connected applications. The older ones often remain valid years later.
4. Cut remote access. The VPN account, the remote desktop, the file share, the device record in whatever manages company machines. Where a shared login was used, disable it and issue a new one.
5. Change the passwords the browser held, in the order money moves: hosting and domain, bank, supplier portals, then the rest.
6. Check the backup before rebuilding anything — and find out which lost files were never in it.
7. Write down what was on the machine and what you revoked, with times. That page answers the insurer, the customer who asks, and the next technician.

Does the login password protect what is on the disk?

No. A login screen guards a running system; the disk can be removed and read elsewhere. Full-disk encryption, the feature shipped with the operating system (BitLocker, FileVault, LUKS), is the only control that changes what a thief gets from the hardware, and only under conditions worth stating plainly: the machine was off or locked when taken, the key is not on a note in the bag, and the recovery key is stored somewhere the company can still reach. A key that existed only on the stolen laptop is one you no longer have.

What was on it	What the thief gains	What you do
A password saved in the browser	That account until it changes	Change it, then what resets through it
A live mail session	The reset channel for every other account	Revoke the sessions, not just the password
The only copy of a file	The file, unless the disk was encrypted	Restore from a backup, or rebuild from the source
A scanned ID or signed contract	Material for impersonation later	Tell the person concerned, keep the record

What should have been on it before it left the office?

Five things, all cheaper before the loss.

• Disk encryption, verified by someone other than the person who enabled it. On some machines the feature waits for the user to finish setting it up, and the recovery key lands in a personal account. Both failures look like "encryption is on" until the day it matters.
• A named account per person, not one shared login. One credential to revoke, one person affected, and a record of who did what.
• A password manager, so credentials can be rotated rather than remembered. A list in a notebook in the same bag is worse than the browser's own store.
• A backup that is not on the machine or in the bag with it. The drive that travels with the laptop is one copy, not two.
• A written list of what the machine can reach. Which tools, which shares, which admin panels. Without it, the first hour is spent remembering, and memory is worst under pressure.

Add one name: who may order the revocation, and who covers for them.

Where this goes wrong

• The password is changed and the sessions are left alive. That is the first hour done, and nothing gained.
• The reset chain is missed. The mail password changes, but the recovery address is a mailbox on the same laptop, or a phone number that belonged to a former employee.
• Encryption is assumed. A login screen with no encryption behind it looks identical from outside; the difference appears when the disk is read elsewhere. Check it on a switched-off machine, not in a settings page.
• The account list is reconstructed from memory three days later. Nobody remembers which supplier portal was open, and the answer becomes "probably not that one".
• Access waits for the police report. The report is worth filing; it is not a prerequisite for revoking a session. Do both, and revoke first.

What this does not cover

Insurance, the police report and the physical security of the premises are separate conversations. Remote wiping is a judgement call: on an encrypted machine that was shut down it removes nothing readable, and on a machine holding the only copy of something it destroys your own data. Duties to inform customers differ by country and contract, and are worth a question to a lawyer before the first customer call rather than during it.

We build the access side of this: named accounts, sessions that can be revoked in one place, and a written list of what each machine can reach before it leaves the office.