Laptop stolen, what to do

Your laptop is stolen when you no longer have it and someone else might. From a phone or a computer you still trust, lock the missing one if tracking was already on. Then change the password for the account that signs in on that laptop, and the password for your email. A browser that was left signed in can be worth more than the files.

The steps differ for a Mac, a Windows PC, a Chromebook, and a Linux laptop. A work machine belongs to the company that issued it. Tell them before you erase anything. The checklist for a managed laptop is Laptop lost or stolen.

If the phone went missing with the laptop, do that device too. Use Phone lost or stolen and What to do if your phone is stolen.

Write down what you still know

Before you click lock or erase, note the last time you had the laptop, the last place, and whether the screen was locked. Write down the model. If you have the serial number, from the box, the receipt, or a devices page, keep it with that note. Law enforcement often asks for it. How you file the report depends on the country. There is no single worldwide form.

Do this from a device and a network you trust. The missing laptop is the wrong place to change passwords, even if someone offers to “return it” so you can.

If it is a Mac

Apple’s lost or stolen Mac page splits the job in two. If Find My was set up before the Mac went missing, you can locate and protect it. If it was not, Find My cannot be added now. Apple says Find My Mac is the only Apple service that can track or locate a lost Mac.

Find My was already on

1. On another Apple device, open the Find My app. On the web, sign in at icloud.com/find.
2. Select the Devices tab, or click All Devices.
3. Select the Mac. You should see an approximate location. If the Mac is not in the list, use the section below for an account that was not set up in Find My.
4. If the Mac is nearby, you can play a sound. That is for a laptop you might have left in the house. Skip it if you already know it was stolen.
5. Turn on Lost Mode in the Find My app. On iCloud.com, select Lost Mac. When a Mac with Apple silicon is marked lost, Apple says it locks with your Apple Account password. When an Intel-based Mac without a T2 security chip is marked lost, you can lock it with a passcode instead. Write that passcode down somewhere other than the missing Mac.
6. Report the theft to local law enforcement. Apple says they might request the serial number.

The Mac has to be powered on and connected to the internet before a lock or an erase can run. If it is offline, Apple says you may still see a location in Find My.

Erase it only if you do not expect to get it back. Apple says a remote erase deletes the data and stops anyone else from reading it. After the erase, Find My can no longer locate that Mac. If the location still matters, leave the erase for later and keep Lost Mode on.

Find My was off

Change your Apple Account password. Apple says that blocks the missing Mac from your iCloud data and from services such as iMessage. Then change the passwords for the other accounts you used on that Mac. Apple names email, banking, shopping, and social media. Report the theft to local law enforcement. They might request the serial number. Apple says you can find it on the original box or the receipt.

You can still remove the Mac from your Apple Account. On an iPhone, open Settings, tap your name, tap the Mac, and tap Remove from Account. On the web, use Devices at account.apple.com and choose Remove from Account. Apple says a removed device loses iCloud, Find My, and the ability to show two-factor codes.

If the Mac is still signed in, and it connects to the internet later, Apple says it can reappear on the account. A permanent removal is a sign-out done on the Mac itself. You cannot do that while it is gone. Lost Mode, or a remote erase, is the control that still works from here.

Can they read the disk?

Apple’s FileVault guide says a Mac with Apple silicon or a T2 chip encrypts data automatically. FileVault is the extra lock. Without your login password, someone should not be able to decrypt the disk. On an older Mac, without Apple silicon and without a T2 chip, the disk is encrypted only if FileVault was already on.

FileVault lives under Apple menu, System Settings, Privacy & Security, FileVault. That menu is on a Mac you still have, or on this one if you get it back. It does not help you turn encryption on from across town.

An unlocked session is a separate problem. If the laptop was awake and signed in, open sites can stay open until you sign those accounts out on the web. Do that next, even when FileVault was on.

If it is a Windows laptop

Microsoft’s Find My Device page covers Windows 10 and Windows 11. It works for a Surface or another PC, and only if three things were already true. You signed in with a Microsoft personal account. That account is an administrator. Find My Device was turned on, with location on for the device.

Microsoft says anyone using the laptop sees a notification when you try to locate it. Know that before you press Find. The person holding it learns that you are looking.

1. Go to account.microsoft.com/devices and sign in.
2. Select the Find My Device tab.
3. Choose the laptop, then select Find if you want the map.
4. When you can see it on the map, select Lock, then Next.
5. After it is locked, Microsoft says you can reset your password for added security.

The serial number is on that devices page, under Info and support. Microsoft also says to tell your insurance company, if you have a policy that covers the laptop.

If Find My Device was never on, the website cannot locate or lock the PC. Change the Microsoft account password from a device you still have, then the email password, then banking.

A BitLocker recovery key saved to your Microsoft account is a sign the drive was encrypted. From another device, open aka.ms/myrecoverykey and sign in with the same Microsoft account. A work or school account uses aka.ms/aadrecoverykey. Microsoft’s recovery-key page says Microsoft Support cannot retrieve, provide, or recreate a lost key. If you never turned on device encryption or BitLocker, treat the files as readable, and rotate every password that laptop could have used.

On a machine you still have, Microsoft’s Surface setup page shows the switch at Start, Settings, Privacy & security, Find my device. Turn that on before a laptop goes missing. It has to be online, with enough battery to report a location, and signed in with your Microsoft account.

If it is a Chromebook, or you only need Google

Google’s lost-device page can sign a Chromebook out of your Google Account. A Windows, Mac, or Linux computer is not listed under Find your phone. For those, Google sends you straight to a password change.

For a Chromebook:

1. Open a browser. If it is someone else’s computer, use Incognito, and close that window when you finish.
2. Open your Google Account.
3. In Security, find Your devices, and select Manage devices.
4. Select the Chromebook. Google shows the last time it was used, and the last city.
5. Next to Account Access, select Sign out. Follow the screen. That removes the Google Account and the connected apps on that Chromebook.

If the Chromebook is not listed, check that you are in the right Google Account. The lost device has to have been signed in to that account in a Google app such as Gmail or YouTube. If it still is not listed, change the password.

Change the Google Account password like this. The same password is the one Chrome, Gmail, and YouTube use.

1. Open your Google Account.
2. In Security, select Signing in to Google.
3. Choose Password. You may need to sign in again.
4. Enter the new password and select Change Password.

Then open passwords.google.com, sign in, and look at Saved passwords. Google says that list is passwords saved to the account, not a list of what was stored only on the laptop. For each important one, open the site itself and change it. Google also says to watch card statements and report fraudulent purchases to the card company.

A Mac or Windows laptop can still show up as a browser session. Google’s devices page lists devices and sessions from the last few weeks.

1. Open your Google Account.
2. Select Security & sign-in.
3. Under Your devices, select Manage all devices.
4. Sign out of every session that belongs to the missing laptop. Google says one device can show several sessions, and you sign each one out on its own.

If it is a Linux laptop

Google’s lost-device page says a Linux computer is not under Find your phone. There is no Find My equivalent in that article for a typical Linux install. You cannot mark it lost from a vendor website unless you set up your own tracking beforehand.

Change the Google password if Chrome or Gmail was signed in. Sign out sessions in Your devices, as above. If the disk was encrypted before the laptop was taken, the files stay unreadable without the passphrase. If it was not, treat the files, SSH keys, and saved logins as exposed. Revoke those keys at the site that accepted them. GitHub, a cloud account, and a server you administer are the usual list. For a key that was sitting in a repository, use API key leaked on GitHub, what to do.

Change the passwords that were on it

Use a computer you still have. Work in this order.

1. The account that owns the laptop. Apple Account, Microsoft account, or Google Account.
2. Email. A signed-in mailbox can reset almost everything else. If the inbox already shows forwarding you did not add, or sent mail you did not write, switch to Personal email account hacked.
3. The password manager, if it was installed or left unlocked. Sign that laptop out inside the manager, from a device you still have. Then change email and banking passwords the vault was holding.
4. Banking, shopping, and social accounts that were saved in the browser.

If the laptop had SSH keys or API tokens, revoke them at the service that issued them. Deleting a file on a machine you do not have does nothing.

Report it

Report the theft to local law enforcement. Bring the serial number, the model, and the last place you had it. Apple asks you to report a stolen Mac. Microsoft asks you to report a stolen Windows device, and to tell your insurer if you have cover. The form, the station, and what they can do with a location from Find My all depend on the country.

Give them the location. Let them handle contact with anyone who has the laptop. Keep Lost Mode or the Windows lock in place until you have it back and you are sure it is yours.

If it is a work laptop

Tell the organization that owns it before you erase it. They may have device management that can lock or wipe the machine, and they may need the serial number for insurance and for any customer data that was on the disk. Your personal Apple ID or Microsoft account may not be the account that can mark it lost.

Use Laptop lost or stolen for the work checklist, including SSH keys, VPN profiles, and a clean replacement. Do not restore a full copy of the old disk onto the new machine. You would copy the same unlocked sessions and the same missing encryption.

What to turn on before the next one

On a Mac you still have, turn on FileVault under System Settings, Privacy & Security, FileVault, and confirm the Mac appears at icloud.com/find. On a Windows laptop you still have, turn on Find my device under Settings, Privacy & security, Find my device, and sign in with a Microsoft personal account that is an administrator. Keep the BitLocker recovery key somewhere other than that laptop. On a Chromebook, confirm it shows under Your devices in the Google Account, and that you can sign it out.

Store the serial number and the recovery key in a password manager, not only on the laptop. Email recovery should not depend on a session that lives only on that machine.

When the missing laptop is locked or wiped, and the email password is new, finish the prepare list in Laptop lost or stolen.

Related playbooks

• Laptop lost or stolen. A work laptop containing sessions, source code, customer data, or recovery credentials is missing.
• Personal email account hacked. Someone else is in your email, which means they can reset the password on almost everything else you own.
• Phone lost or stolen. Your phone is gone, and it is signed in to your email, your bank, your messages, and the codes that protect everything else.