Company Laptop Stolen in Houston? 8 Steps Before a Breach

1. Is the laptop cut off from company email and files?

Microsoft documents that access tokens issued by Entra ID last one hour by default, so a stolen laptop that is already signed in can keep reading mail until its sessions are revoked and its token runs out. That is why this comes before anything else. A thief who opens the lid while the laptop is still signed in does not need the password. The cached session does the work.

Your IT provider should be able to tell you, within the hour, that the user's sessions were revoked, the password was changed and the stolen laptop is no longer trusted by Microsoft 365. Ask whether anyone signed in from that laptop after it went missing, and ask for the time each of those things happened. If the employee used the same password anywhere else, that account needs a new one too.

Get it in writing: the time access was cut off, and whether the sign-in log shows any activity after the theft.

2. Is a remote wipe queued?

Microsoft's guidance is explicit that a remote wipe needs the device connected to the internet, and that an offline device still has access to any locally stored data. A wipe sent at 2 p.m. does nothing until the thief connects the laptop, which might be an hour later or never. That is the reason to send it early: queued is better than unsent.

Microsoft also offers a wipe for stolen Windows laptops that keeps going even if the device loses power, with the trade-off that some machines may not start again. For a laptop you are not getting back, that is an acceptable trade. If the laptop was never enrolled in device management, there is nothing to send, and that gap changes what the Texas question in item 7 has to assume.

Get it in writing: when the wipe was sent, whether the laptop has connected since, and when the wipe completed.

3. Can anyone prove the drive was encrypted?

Texas law treats encrypted data as breached only if the person who took it has the key needed to decrypt it, so the encryption record for a stolen laptop is the most important document anyone will pull this week. Owners tend to answer this from memory. The answer should come from the device record, which shows whether BitLocker was on and where the recovery key was stored.

Two details change the answer. Microsoft's BitLocker guidance says a laptop resuming from sleep does not ask for a startup PIN, and recommends shutting down or hibernating a device before it leaves an authorized user's control. A laptop that was asleep in the bag is in a weaker position than one that was shut down. And a password on a sticky note in the same bag is, for practical purposes, the key traveling with the data.

Get it in writing: the encryption status from the device record with the date it was pulled, where the recovery key is kept, and the employee's own words on whether the laptop was shut down, asleep or open, and whether any password was written down in the bag.

4. List what lived on the laptop, so you know whose data walked off

A stolen laptop rarely holds only one person's work: cached email, synced folders, downloaded client files and passwords saved in the browser all ride along, and each one belongs on a written list. The list decides two things later. It tells counsel whether sensitive personal information was on the drive, and it tells you which passwords and accounts beyond Microsoft 365 need to be changed today.

We see the same pattern with Houston field crews again and again: the laptop that rides in a truck is the one with the most saved passwords, because the person using it signs in from jobsites, gas stations and customer offices and lets the browser remember everything.

1. Note whether Outlook kept a local copy of the mailbox and how many months it covered.
2. List the OneDrive and SharePoint folders synced to the laptop, and the Downloads and Desktop folders the employee used.
3. Flag any file with Social Security numbers, driver's license numbers, bank or card numbers, or health information.
4. Change every password saved in the browser, plus VPN, Wi-Fi and line-of-business app credentials stored on the machine.

5. File the police report the same day, so the theft has a case number

The Houston Police Department lets victims report qualifying motor vehicle burglaries online when the total loss is $50,000 or less, and the portal issues a temporary case number that HPD notes is a reference number, not an official HPD incident number. A laptop taken from a parked truck inside city limits usually fits. HPD gives you 30 days to complete a report once you start it, but there is no reason to wait.

Outside HPD's jurisdiction, the local agency runs its own process. Katy, Sugar Land and unincorporated Harris County all sit with different departments, and HPD's own page warns that an address that looks like Houston may belong to another agency. If anyone saw the thief or there is evidence for police to collect, call instead of filing online.

1. Have the employee who had the laptop file the report, and name the company as the owner of the laptop.
2. Include the make, model, serial number and asset tag from your hardware inventory.
3. For anything outside the online criteria, call the HPD non-emergency line at 713-884-3131, or the agency that covers the address.
4. Save the case number in the incident file and send it to your insurance broker with a short note.

6. Write the timeline today, because the Texas clocks run from your own dates

Under Texas Business and Commerce Code Section 521.053, notice deadlines count from the date a business determines a breach occurred, so a written, timestamped record of the stolen laptop response is what lets you show when that date was. Memory fades in days. An email thread with half the facts is worse than nothing, because it shows people knew things without showing what they did about them.

Keep it plain. One document, one owner, every entry with a date and time. In 35+ years doing this, the incidents that went smoothly with insurers and attorneys were rarely the ones with the best technology. They were the ones where someone wrote things down as they happened.

1. Record when the laptop was last seen, when it was noticed missing, and when IT was told.
2. Record when sessions were revoked, when the password was reset, when the wipe was sent and when it completed.
3. Attach the encryption export from step 3, the data list from step 4 and the case number from step 5.
4. Note every person told, including your attorney and insurance broker, with the date and time of each call.

7. Run the Texas breach test with counsel, so the decision not to notify is on paper too

Texas defines sensitive personal information as a name combined with a Social Security number, a driver's license or government ID number, or a financial account or card number with its access code, when those items are not encrypted, plus information identifying an individual's health or health care. Put the data list from step 4 next to that definition and the answer is usually clear within an hour. Run the test inside the first week, while the facts are fresh.

The encryption record from step 3 decides most of these. Section 521.053 counts encrypted data as breached only when the person accessing it has the key. HIPAA works the same way for healthcare practices: HHS guidance says encrypted health information is secured only if the decryption key has not been breached, and tells covered entities to keep decryption tools on a device or at a location separate from the data. A password in the laptop bag fails both tests.

The penalties are real money. Section 521.151 sets a civil penalty of $2,000 to $50,000 per violation, plus up to $100 per person per day for failing to notify, capped at $250,000 for a single breach. Tax practices have one more clock: the FTC Safeguards Rule requires notifying the FTC within 30 days of discovery when unencrypted information of 500 or more consumers is involved.

1. Call your attorney and your cyber insurance carrier before deciding anything, and log both calls in the timeline.
2. Compare the step 4 data list against the Texas definition, and against HIPAA or the FTC Safeguards Rule if they apply to you.
3. Count affected people and separate out Texas residents, since 250 is the Attorney General threshold.
4. If the answer is no breach, write down why, with the encryption export attached. That memo is your defense if the question comes back.

8. Rebuild from a managed build and fix the gap, so the next theft costs only hardware

A replacement laptop that is enrolled in device management, encrypted with a startup PIN and restored from backup before handoff turns the next truck break-in into a hardware purchase instead of a breach investigation. Every gap steps 1 to 7 turned up becomes a line item here. A laptop that was never enrolled gets enrolled. A drive that was TPM-only gets a PIN. A browser full of saved passwords gets a password manager.

Microsoft's BitLocker guidance recommends a TPM with PIN protector, disabling standby and hibernating or shutting down before a device leaves its user's control for machines that face skilled attackers with physical access. A laptop that spends nights in a truck at a Katy jobsite or a Pasadena yard is a fair candidate for that list, even if the employee finds the extra PIN annoying for the first week.