A laptop was stolen at 4:40pm. By 5:10pm it was an insurance claim instead of a breach.

A laptop was stolen from a co-working space at 4:40pm on a Tuesday. By 5:10pm it was an insurance claim instead of a breach. Here is the first hour, in order, and the mistakes we'd made in the previous incident that made this one boring.

Why this story exists

A few years ago I watched the other version of this incident: a laptop went missing Monday, nobody reported it until Thursday because "it's probably in the car," and the machine had FileVault off, saved passwords in the browser, and an SSH key with no passphrase. Three days of sessions, tokens, and mailbox access we never fully accounted for.

So this time we had a one-page rule: revoke first, paperwork second. The thief cannot be slowed down by your forms.

The first 10 minutes

1. Identity reset + sign-out everywhere. One action, not two: rotate the password in the IdP and kill all active sessions. Most suites keep sessions alive after a password change — a reset without sign-out is a door you think you locked.
2. Revoke MFA devices and app passwords for that user. The laptop may hold an enrolled authenticator that keeps approving prompts after the password changes.
3. Locate/lock, then remote wipe. Wipe takes a while; starting it at minute 3 is what makes it finish by midnight.
4. Revoke network access: VPN account, device certificate, WiFi/zero-trust entry. A wiped-but-online laptop with a valid VPN cert is still a door.

Assume the disk is readable — then make it not matter

We checked the MDM record before assuming anything: FileVault enforced at onboarding, recovery key escrowed. On that disk: cached email, browser passwords, a .env file from a side project. Here's the part most teams skip — we rotated anyway. SSH keys, GitHub tokens, API keys in dotfiles, browser-stored admin passwords. Ten minutes of rotation because the cost asymmetry is brutal: rotating is ten minutes, explaining to a customer why their data walked out of a coffee shop is not.

The disk held a customer contact export. Encrypted at rest, so our disclosure assessment was one paragraph: "device encrypted, keys escrowed, evidence in the incident record." "Probably fine" is not a defensible conclusion. That sentence is.

The paperwork (30 minutes, while the trail is fresh)

• Police report (insurers want the number, not a manhunt — non-emergency line is fine)
• Insurance claim with the serial number from the asset inventory
• Written incident record: timeline, actions with times, encryption status, what was rotated, what we're watching
• A 72-hour watch on the account: new sign-ins, new MFA devices, mailbox rules added (the classic post-theft persistence trick)

The debrief rule that made this work

The person who lost the laptop reported it in four minutes because the first time this happened to a colleague, the response was thanks and a runbook — not blame. Punish the first report and the second laptop goes unreported for three days. That's the whole security model: you can't revoke what nobody tells you about.

Prevention, if you do nothing else

• Enforce disk encryption at onboarding, escrow the recovery key centrally
• Enroll every laptop in remote wipe; test the wipe once so you know what it does
• Secrets live in the password manager, not in .env files and browser vaults
• Backups that make hardware disposable — then a theft is purely an access incident, which is the one you can control

If you want the full runbook (the first-ten-minutes order, the disk-readability assessment, the paperwork sequence, and the prevention pass), we published it as a free page: https://hive80-lab.github.io/ops-notes/lost-or-stolen-laptop-runbook.html

The incident record and asset inventory sheets it leans on are in the Ops Starter Kit ($14); the 72-hour watch (sign-in alerts, new devices, mailbox rules) as a daily automated check is in the Automation Starter Pack ($19). Launch week: 30% off with code HIVE-LAUNCH30 (ends tonight, Sep 11 23:30 ACST) at https://hive80lab.gumroad.com

Free starting point: The First 30 Minutes — the one-page quick-start for any incident: https://hive80lab.gumroad.com/l/first-30-minutes