What to Do If a Business Laptop Is Stolen (and How to Remotely Wipe It)

Write down what you know

Done when: I've written down the device name, serial number, who used it, when and where it went missing, and what was on it.

You'll need these details for the police report, your insurer, and every step below. Microsoft shows a Windows device's serial number at account.microsoft.com/devices under Info and support (Microsoft Support). Apple notes the serial number is also on the original box or receipt (Apple Support). If you use Intune, it's on the device's page in the Intune admin center.

Also note what was on the laptop: customer or employee records, saved passwords, banking or payment details, and which business apps were signed in. The FTC advises businesses to document their investigation (FTC). Keep these notes from the start.

Report it to the police

Done when: I've filed a police report and saved the report number.

Apple and Microsoft both recommend reporting a stolen device to local law enforcement, and police may ask for the serial number (Apple Support; Microsoft Support). Microsoft also suggests telling your insurance company. If personal information may be involved, the FTC says to tell police right away and mention the risk of identity theft. If your local police aren't familiar with information compromises, the FTC says to contact the local FBI office or the U.S. Secret Service (FTC).

Don't try to get the laptop back yourself if a location shows up on a map. Give the location to the police.

Locate and lock it

Done when: I've tried to locate the laptop and locked it (Intune, Windows Find My Device, or Apple Find My).

Use whichever tool your business set up:

• Microsoft Intune (company-managed devices): In the Intune admin center, go to Devices > All devices, pick the device, and choose Locate device. On Windows, this only works if a location policy was set up beforehand (Microsoft Learn). Intune's Remote lock (under Secure > Remote lock) works for Macs, iPhones, iPads, and Android, but not Windows laptops, and only helps if a passcode was already set (Microsoft Learn).
• Windows Find My Device: Go to account.microsoft.com/devices, open Find My Device, select the laptop, and choose Find, then Lock. This works only if Find My Device was turned on before the theft and the laptop is signed in with a personal Microsoft account (Microsoft Support). Many business laptops use work accounts instead, so Intune is often the better tool.
• Apple Find My (Mac): On another Apple device open Find My, or go to icloud.com/find. Select the Mac and turn on Lost Mode (called Lost Mac on iCloud.com). A Mac with Apple silicon is then locked with the Apple Account password (Apple Support). If your Macs are company-managed, Intune's Remote lock works too.

Lock and wipe commands only reach a laptop that's turned on and online (Apple Support; Microsoft Learn). Send them anyway. They'll run if the thief connects it to the internet.

Wipe it if you don't expect to get it back

Done when: I've sent a remote wipe (or decided to wait, and written down why).

Apple's advice: if you don't think you can get the Mac back, erase it remotely. Erasing deletes your data, and after that you can no longer find the Mac in Find My (Apple Support). The same tradeoff applies to Windows, so try locating it first.

• Intune (Windows, Mac, and more): Devices > All devices > select the device > Remove data > Wipe (Microsoft Learn). For a stolen Windows laptop, Microsoft describes "Wipe device, and continue to wipe even if device loses power" as the option for lost or stolen devices. Microsoft warns that it can leave some devices unable to start up again, so use it only on company-owned devices. For a Mac, Intune asks for a 6-digit recovery PIN. Write it down.
• Apple Find My: Select the Mac and choose Erase This Device. If the Mac is offline, the erase starts the next time it connects (Apple Support: Find My). Activation Lock stays on, so the thief still needs your Apple Account password to reuse it (Apple Support: iCloud).

Wiped data can't be recovered (Microsoft Learn). If the laptop held the only copy of something, check your backups first.

Sign the laptop out of everything and reset passwords

Done when: In Microsoft 365, I've revoked the user's sessions and reset their password. Every password saved in the laptop's browser or password manager has been changed. The device is disabled in Entra now and deleted after the wipe. A Mac is off the trusted-device list but still in Find My.

Someone holding the laptop may still be signed in to email, files, and apps. In the Microsoft Entra admin center, go to Entra ID > Users > All users, select the user, and choose Revoke sessions. That stops their sign-ins from getting new access tokens (Microsoft Learn). Then reset the user's password.

Revoking isn't instant everywhere. By default, Microsoft's access tokens last one hour, and some apps keep their own sign-in sessions until those expire (Microsoft Learn). If someone may have misused the account, Microsoft's emergency steps also include disabling the account, and the user's devices, until you've sorted it out.

Outside Microsoft 365, Apple says to change your Apple Account password, plus passwords for other accounts used on the computer, such as email, banking, and shopping (Apple Support). Start with every password saved in the laptop's browser or password manager, and with any account that doesn't have MFA. If the password manager's vault was unlocked or set to stay signed in on that laptop, change its master password and sign that device out from the password manager's admin or account page.

Then clean up the device record. A wipe clears the device, but it doesn't sign out sessions or tokens that may already have been copied off it. That's why revoking sessions and resetting passwords matters even after a wipe.

• Microsoft 365 / Entra / Intune: In Intune, leave the laptop listed until its wipe shows as complete. Deleting it first can leave the wipe with nothing to send it. To block it now, disable the device in Microsoft Entra ID (Entra ID > Devices > select it > Disable). Disabling a user's devices is part of Microsoft's emergency steps. After the wipe finishes, you can delete the device record, which Microsoft lists as an optional final step (Microsoft Learn; Microsoft Learn).
• Apple: Remove the Mac from your Apple Account's trusted-device list so it can't receive verification codes (Apple Support), but leave it in Find My so Activation Lock stays on (see the warning in Step 4). Apple notes you can remove a stolen device from your account's device list without removing it from Find My (Apple Support). Change your Apple Account password too (Apple Support).

Check whether the drive was encrypted

Done when: I know whether the laptop's drive was encrypted (BitLocker or FileVault), and I've written down how I checked.

Encryption is a big deal here. It's what keeps a thief from pulling files off the drive. The FTC tells businesses to find out whether measures such as encryption were on when a breach happened (FTC). You can't check the laptop itself anymore, but you can check these:

• Intune encryption report: Devices > Manage devices > Configuration > Monitor > Device encryption status shows whether the operating system drive was encrypted the last time the device reported in (Microsoft Learn).
• Windows BitLocker recovery keys: If the laptop was signed in with a work account, its BitLocker recovery key may be saved in your Microsoft 365 organization (aka.ms/aadrecoverykey, under Devices > View BitLocker Keys). For a personal Microsoft account, check aka.ms/myrecoverykey (Microsoft Support). A saved key is a good sign BitLocker was turned on, but it doesn't prove it. Windows Device Encryption turns on automatically when a supported device is set up with a Microsoft account or a work account, but not with a local account (Microsoft Support).
• Mac FileVault: Macs with Apple silicon or a T2 chip encrypt data automatically. FileVault adds a requirement for the login password before the data can be decrypted. Older Macs without those chips are only encrypted if FileVault was turned on (Apple Support).

Write down what you found. Whether the drive was encrypted can affect what you have to do in Step 8, so share it with your lawyer.

Call your bank if payment or banking info was on it

Done when: My bank, card processor, or both know about the theft if banking or payment details were on the laptop.

If the laptop had saved bank logins, card numbers, or payment files, call your bank and card processor today. They can watch for fraud and tell you what they need. If customers' card or bank account numbers were taken and you don't run those accounts, the FTC says to notify the institution that does so it can watch for fraud (FTC). Your agreement with your bank or card processor may also include extra security obligations (FCC).

If you see fraud or account takeover tied to the theft, such as strange wire requests, new payees, or logins you don't recognize, also report it to the FBI's Internet Crime Complaint Center at ic3.gov, the main place to report cyber-enabled crime (FBI IC3).

Find out whether you have to notify anyone

Done when: I've listed whose personal information was on the laptop and talked to a lawyer about notice duties.

If personal information about customers, patients, or employees was on the laptop, you may have legal duties to notify people. Every U.S. state, plus D.C., Puerto Rico, and the Virgin Islands, has a law requiring notice of security breaches involving personal information. Other rules may also apply depending on the type of data, such as HIPAA for health records (FTC). The FTC's Data Breach Response: A Guide for Business walks through who to notify and how, and recommends talking with legal counsel. The FTC also suggests pointing affected people to IdentityTheft.gov for recovery steps.

Texas businesses: Texas law requires notifying affected individuals without unreasonable delay and no later than 60 days after you determine the breach occurred. If the breach involves at least 250 Texas residents, you must also notify the Attorney General as soon as practicable and no later than 30 days after that determination, using the AG's online Data Breach Report form (Tex. Bus. & Com. Code § 521.053(b), (i); Texas Attorney General). Encrypted data generally isn't covered, unless whoever took it also has the key to decrypt it (§ 521.002(a)(2), § 521.053(a)). That's another reason Step 6 matters: a laptop stolen with its password on a sticky note may not count as protected. The AG's office can't give legal advice, so ask your attorney how this applies to you.

Not legal advice. Whether a stolen laptop counts as a reportable breach depends on what data was on it, whether it was encrypted, where the affected people live, and other facts. Talk to a lawyer before you decide.