On this page
What should I do if a work Mac is lost or stolen?
Tell the person responsible for security at once, and write down when and where the Mac was last seen. Follow your approved process for lost devices, including Apple’s Find My options if they were turned on. Review account access from a trusted device.
Then keep the facts you will need to work out which company or client information could be affected.
What does Find My do for a Mac?
What Find My does for a Mac.
Find My is Apple’s service for finding a missing device. For a Mac it can show where it is, and lock or erase it from another device.
It only works if it was turned on before the Mac went missing. A lock or an erase you send runs when the Mac next goes online, so check that it actually happened.
Make the first message useful.
You get to the office and the laptop bag is not with you. The first useful step is to tell the right person, even while you keep looking. Do not wait until the end of the day to avoid an awkward conversation. Early news gives the business more time to protect access and to help you get the Mac back.
Say which Mac it is, where and roughly when you last had it, and whether it was locked, asleep or in use. Name the client projects and important accounts you were working in. Stick to facts. “The Mac was locked when I left the train” is more useful than “I think everything is fine”. And write down what you do not know yet.
Luca’s first report26.09.2026
missing Macreported
17:40
Luca’s MacBook Pro is missing.
- Last seenOn the train, about 17:15
- State thenLocked, lid closed
- Working inClient website, company email
Not known yet: left on the train, or taken.
Use the controls you already set up.
Apple’s Find My can locate or protect a missing Mac, if it was set up beforehand. Follow Apple’s current instructions and your company’s approved process. If your company manages its Macs with extra controls, let the authorised person use them. Do not assume the missing Mac is online, or that a remote action has finished.
A command that was sent and a command that was confirmed are two different states. Before an erase that cannot be undone, talk through recovery, evidence and company policy with the person responsible. If you think the Mac was stolen, report it to the police. Do not try to get it back from someone yourself. Keep the serial number and the police report reference to hand.
Provider guidance: Apple: if your Mac has been lost or stolen
the first responsethree steps
- 1
Report.
Who is reporting, which Mac, when and where.
- 2
Protect.
Use the approved controls for the device and for the accounts.
- 3
Assess.
Record the evidence, each decision and each confirmation.
Review the access the Mac carried.
From a trusted device, list the accounts, open sessions and stored credentials that may need attention. Start with business email, admin access and sensitive client services. Use each provider’s process to end sessions or change access. Do not assume one new password signs the missing Mac out of every service, or cancels every separate API key.
Teams that build software or work with AI tools should include what is connected to code repositories, to deployments and to outside services. Work out which credentials were stored on the Mac or could be used from it, without copying their values into the incident notes. Follow the incident owner’s decisions about cancelling and replacing them, and check whether a change affects scheduled work or colleagues who share that access.
Why is one new password not enough?
Why one new password is not enough.
Many services keep you signed in on each device for days or weeks. That open session can outlive a password change. And an API key works without any password at all.
So look for each service’s own control that signs a person out everywhere, and cancel keys at the service that issued them.
Keep the facts apart from conclusions.
A recent record of disk encryption and screen lock settings can show what was switched on for an assessed Mac. It cannot prove that nobody saw the screen before it locked, used an open session or copied information before the loss. Keep the last observed state of the Mac together with the time it was observed, especially if the Mac has been offline since.
the first question, the same evening
Could anyone read the files on Luca’s missing Mac?
Too sure
“It was encrypted. There is no risk.”
- It gives no time for the last check.
- It rules out things nobody can check yet.
- It may have to be taken back tomorrow.
It sounds calm. It claims more than the record shows.
Supported by the record
“Disk encryption and screen lock were on at 17:12, the last time the Mac was observed. We cannot say yet whether an open session was used before the loss.”
- It gives the time of the last observation.
- It names what the record cannot show.
- It still holds when new facts arrive.
Ana can act on every word of it.
Work out which information may be involved and which clients or other parties you need to tell, under your agreements and the rules that apply to you. Get incident or legal advice where you need it. Do not announce that data was taken, or that there is no risk, before the facts support it. Keep a timeline of reports, decisions, actions and confirmations.
What does disk encryption protect?
What disk encryption protects.
Disk encryption scrambles everything stored on a Mac, so a lost or stolen laptop cannot be read without the password. On a Mac it is called FileVault.
It protects the files on a Mac that is switched off or locked. It does not protect a session someone left open, or copies that already left the Mac.
Use the incident to improve the everyday routine.
Once the urgent part is handled, restore work from a trusted backup or onto a replacement Mac through your normal process. Look at what made the response easier and what was missing: current device records, recovery information, a contact route or a tested backup. Give each improvement an owner, so it becomes part of how the business works and not a lesson everyone forgets.
cybee’s records show the last assessed security state of each Mac. Its training prepares people to report a lost Mac. cybee does not replace Apple’s location service or your backup system, so keep those jobs apart. The best time to agree who does what is before the next bag goes missing.
What to remember.
- Report early, and record the facts, including what is still uncertain.
- Check that remote actions finished, and review the accounts separately.
- An earlier security record informs the assessment. It does not prove that no data was accessed.
Sources and further reading.
Written by cybee for small teams. Product scope and provider guidance can change, so check the linked source for your own setup.
Prepare your team before the next bag goes missing.
See how cybee assigns short trainings from your AI assistant and records who completed them.
