How Experts Track Stolen Laptops
Key Takeaways
- Tracking a stolen laptop and recovering it are two different problems — visibility alone doesn't get the device back.
- A structured response (assess, involve law enforcement, assess data risk) recovers stolen devices far more reliably than going it alone.
- Physical theft or loss still accounts for a meaningful share of breaches, and the cost of a breach has never been higher.
- What happens to the data on a stolen device, not just the hardware, determines whether an incident becomes a compliance problem.
How We Track Stolen Devices
From large enterprise to small business and everyone in between, lost and stolen laptops are a real and ongoing problem. In one widely cited case, the British Broadcasting Corporation (BBC) reported that over 170 laptops, tablets, and mobile phones had been lost or stolen over a two-year period. The devices have a replacement cost, of course, but the greater concern is almost always the data that resides on them.
That risk hasn't gone away. Physical theft or loss still accounts for a meaningful share of all data breaches, and the cost of getting it wrong keeps climbing: the global average cost of a data breach hit a record $4.99 million in 2026, up 12% year over year (IBM, Cost of a Data Breach Report, 2026), and physical device theft or loss alone was involved in roughly 5% of breaches analyzed in the (Verizon 2026 Data Breach Investigations Report).
This isn't just a private-sector problem. A 2025 Freedom of Information release found that the (Scottish Government reported 28 laptops lost or stolen in a single year across its departments, a reminder that device loss touches organizations of every size and sector, not just the ones that make headlines.
Compliance exposure compounds the problem. Failing to protect personal information under regulations like GDPR and HIPAA carries real financial consequences: MD Anderson Cancer Center was ordered to pay $4.3 million in HIPAA civil penalties after a 2012–2013 incident in which a stolen laptop and two lost thumb drives exposed the protected health information of more than 35,000 individuals, because the devices weren't encrypted. Cases like this are part of why a structured, repeatable response matters more than any single piece of tracking software.
At Absolute, our Investigations and Recovery Team tracks and recovers lost and stolen devices on behalf of our customers. Since the team's formation in 1993, it has helped customers around the globe recover more than 50,000 laptops. To track and recover a stolen laptop, the team follows three steps.
Step 1: Assess the Situation
When a customer reports a stolen laptop, our recovery agents immediately assess the situation using the investigative skills of our team members along with our patented Persistence technology, which provides visibility into the state of the device and offers controls to remediate issues quickly, whether the device is on or off the network.
Step 2: Contact Law Enforcement
Based on the initial assessment, our team works with contacts at over 6,500 global law enforcement agencies. Team members are certified in information security, and most are former state and federal law enforcement agents with significant investigative experience. This step is valuable to organizations because most don't have the bandwidth to work directly with law enforcement, and many companies don't authorize employees to file a police report on the company's behalf in the first place.
Step 3: Recommendations on Handling Data
If a stolen device is found to contain sensitive information, our team can remotely freeze or delete that data and provide a Risk Analysis report within the first 72 hours, in line with GDPR requirements. This third-party assessment includes action recommendations, including whether the device was encrypted, which tells the organization whether notifying affected individuals and regulators is required.
One tip worth repeating: if a device goes missing and you're an Absolute customer, call us before you freeze the device yourself, even if you have that capability. Our experts can look into the incident and determine the best course of action, coordinate with law enforcement if needed, and confirm whether the device's data was encrypted, so you know whether reporting is necessary under GDPR or similar requirements.
Why Tracking Isn't the Same as Recovery
It's worth repeating because it's so often missed: device tracking isn't device recovery. Knowing where a stolen laptop is, or that it's still checking in, is not the same as getting it back safely, confirming what happened to the data on it, or closing out the incident from a compliance standpoint. Attempting to recover a stolen device on your own, rather than through trained investigators and the proper law enforcement channel, can compromise evidence or even create legal risk for the person doing the recovering.
This distinction matters just as much before a device ever goes missing. The organizations that recover fastest are usually the ones with persistent visibility and automated controls already built into their endpoint fleet, not just a tracking agent installed after the fact.
When a laptop is stolen, the stakes go well beyond the replacement cost. Sensitive data can fall into the wrong hands, leading to compliance violations and reputational risk, which is exactly why having a well-defined, tested recovery process matters.
For a closer look at the tools and techniques organizations use to track devices before they're ever stolen, see our companion guide, How-To Guide: Tracking and Recovering Laptops.
Want to see how Absolute's Investigations and Recovery Team and built-in endpoint resilience can protect your organization? Request a demo to see our solutions in action, or explore our resource library for more.
