MSRXPlaybooks / Lost or stolen device
A work device was lost or stolen
A laptop or phone with company data, saved logins or VPN access is gone.
Use this as soon as you realise. The question is what that device could open.
Right away
- Use the device finder (Find My, Find Hub, or your MDM) to lock it, show a message, or wipe it remotely.
- Sign the device out of accounts from the web: revoke sessions and tokens for mail, chat, cloud storage, code hosting and the VPN.
- Change the passwords for anything saved in the browser or password manager on that device.
Assess the exposure
- Was the disk encrypted (BitLocker, FileVault) and the screen locked with a strong passcode? If yes, the data is very probably safe.
- List what was on it: customer data, credentials, source code, keys. Personal data on an unencrypted device can be a reportable breach.
- Tell your security contact, and the police if it was theft, for the insurance claim.
Prevent the next one
- Require full-disk encryption, a screen lock and remote wipe on every device that touches company data.
- Prefer cloud storage over local copies, and sign-in with hardware keys or passkeys.
General guidance, not legal or forensic advice. For a serious incident, involve a professional incident-response firm.