The Lost Laptop on the Train
Sofia is a field sales rep. Her work laptop was stolen from a train. It contained a local copy of the customer contact database (about 3,000 records with names, emails and phone numbers) and her saved browser passwords. The laptop had a login password but no full-disk encryption. Sofia had not backed up for three weeks. She remembers she had used the same password for the laptop, her personal email and a shopping site. She reports the loss to IT on Monday morning.
1. Rank the risks from this loss and explain which is most serious.
Read the worked answer
Risks, roughly in order of severity:
- Credential reuse - the attacker can try the laptop password on her personal email and shopping account. If any of those hold password-reset links to work systems, this cascades into account takeover. Most serious, because it is remote, fast and escalates.
- Unencrypted customer data - names, emails and phones are personal data; without encryption the disk can be read by removing it.
- Lost work - three weeks of unsaved data.
Why credential reuse ranks first: the attackers do not need physical access to the laptop to exploit it, and a compromised personal email can be used to reset work accounts.
2. What should Sofia and IT do in the first 24 hours?
Read the worked answer
Sofia:
- Change the reused password everywhere it was used, starting with personal email.
- Enable multi-factor authentication on those accounts.
- Report the loss formally so it can be logged.
IT:
- Remote-wipe / disable the device account if device management allows.
- Revoke saved sessions and force a password reset on her work account.
- Assess whether the lost data triggers a breach-notification duty.
- Review why full-disk encryption was not enforced - this is the control that would have contained the data risk.
3. Which single control would most have reduced the damage, and why not the login password?
Read the worked answer
Full-disk encryption.
A login password only guards the running operating system. An attacker with the physical disk can mount it in another machine or boot from removable media and read files directly. Encryption ties the data to a key, so a stolen disk is unreadable.
The login password was not useless - it slows casual access - but it does not protect data at rest once the hardware is out of your control. Encryption plus remote wipe plus MFA is the layered answer.