Could a Stolen Lawyer's Laptop Expose an Entire Client Matter?

It happens fast. A lawyer sets a laptop bag down at a coffee shop for thirty seconds to grab a napkin, and when they turn around, it’s gone. Or a car gets broken into overnight, and the laptop on the back seat disappears along with a phone charger and a pair of sunglasses. It’s not dramatic. It’s not a sophisticated hack. It’s just theft.

But when the laptop belongs to a lawyer, the stakes change. That machine might hold years of client correspondence, financial records, settlement details, and privileged communications, or provide access to systems containing them. If it isn’t properly protected, one stolen laptop can turn into a serious security incident, a potential privacy breach, a law society complaint, and difficult conversations with affected clients.

Small firms are especially exposed here. Larger firms often have dedicated IT departments and strict device policies. Smaller firms run leaner, and laptops move between the office, the courthouse, and home more freely. That flexibility is great for productivity. It’s also exactly the kind of gap that can turn a stolen device into a client matter exposure event.

Encryption: The First Question That Decides Everything

The first thing that matters after a laptop goes missing is whether its drive was properly encrypted. If it was, and the device was locked and the encryption key remained secure, the information stored on it should be extremely difficult to access. Without the encryption key, the files appear as scrambled, unreadable data. If it wasn’t encrypted, someone with basic technical knowledge may be able to remove the drive or bypass the operating system login and read the files.

Full-disk encryption tools such as BitLocker on supported Windows devices and FileVault on Mac are built into the operating system. But having encryption available isn’t the same as having it properly enabled, configured, and verified across every device. In many firms, protection still depends on whether an individual lawyer happened to turn it on themselves. That’s not a policy. That’s a coin flip. We cover how encryption works, and where firms tend to get it wrong, in Navigating the Complex World of Data Encryption.

Remote Wiping: Your Second Line of Defence

Encryption protects data stored on the device. Remote wiping gives the firm another way to respond once a device is confirmed missing. With the right device management tools in place, a firm may be able to remotely lock or erase a stolen laptop after it reconnects to the internet, limiting the time available for someone to access it.

The catch is that remote wipe only works if the device was enrolled and properly configured before it disappeared. It may also depend on the device reconnecting to the internet and remaining manageable. There’s no retroactive fix. This safeguard has to be in place quietly, in the background, long before anyone needs it.

MFA: Why a Stolen Password Shouldn’t Be Enough

Multi-factor authentication can help stop someone with a stolen device or compromised password from getting into a lawyer’s email, case management system, or cloud drive. Passwords get reused, written down, and saved in browsers more often than anyone wants to admit. A stolen laptop with saved credentials and no MFA can become an open door to everything that account touches.

MFA adds another checkpoint; a secure authenticator prompt, hardware key, biometric factor, or another verification method the thief shouldn’t have. But MFA isn’t a complete solution on its own. Existing signed-in sessions may still need to be revoked, and weaker methods can be vulnerable to phishing or repeated push-notification attacks. 

Local File Storage: The Habit That Quietly Creates More Risk

Here’s where firms lose the plot without realizing it. Encryption is on, MFA is enabled, remote wipe is configured and lawyers are still saving client files directly to the laptop’s desktop or downloads folder instead of working within the firm’s approved document management or cloud storage environment.

Full-disk encryption still protects properly encrypted local files when a device is locked. But those files may sit outside the firm’s normal backup, version control, retention, access logging, and data loss prevention processes. A file saved only on one laptop lives and dies with that physical device. If it isn’t backed up elsewhere, losing the laptop may mean losing the file, not just creating a risk of exposure.

The fix isn’t complicated: build the habit of working from approved, securely configured cloud storage or a document management system, with appropriate access controls and backups.

Device Management: Knowing What You Have Before Something Goes Wrong

Everything above only works if a firm actually knows which devices are out there in the first place. Many small firms don’t have a current, accurate list of every laptop, phone, and tablet that touches client information, who has it, and how it’s configured. When something goes missing, questions like “Is encryption on?” and “Is the wipe tool configured on this specific machine?” should have instant answers. Instead, it often takes a scramble through old emails and IT invoices.

This is where a proper device management setup earns its keep. Every new laptop gets provisioned the same way before it ever leaves the office: encryption enabled and verified, device management installed, password and screen-lock policies applied, software updated, and access configured according to the user’s role. It also gets logged so the firm knows exactly who has which device at any given time.

Cyber Insurance: What Insurers Expect Firms to Maintain

This is the part that catches firms off guard. A cyber insurance policy isn’t a blank cheque that automatically pays out the moment something goes wrong. Insurers increasingly ask detailed questions during underwriting and after an incident: Was the device encrypted? Was MFA in place for the affected systems? Were devices centrally managed? Did the firm follow the controls and policies it represented on its insurance application?

The absence of a particular safeguard doesn’t automatically mean a claim will be denied. Coverage depends on the wording of the policy, its exclusions and conditions, the accuracy of the firm’s insurance application, and the circumstances of the incident. But inaccurate answers about security controls or a failure to meet specific policy requirements can create serious coverage problems right when the firm needs support most.

Cyber insurance and IT security aren’t really separate conversations anymore. The safeguards covered here aren’t just good practice, they’re increasingly part of the baseline insurers evaluate when deciding whether to offer coverage, what that coverage will cost, and how a claim will be handled. This cyber insurance checklist lays out the controls insurers commonly look for, and it’s worth a read before your next renewal, not after a claim.

Putting It All Together

A stolen laptop doesn’t have to mean an exposed client matter. Firms that come through a theft with nothing worse than the cost of a replacement device are usually the ones that already had encryption, remote wipe, MFA, secure file storage, and real device management working in the background.

Even then, the incident still needs to be assessed and documented. Under Canadian privacy rules, whether regulators or affected individuals must be notified depends on factors such as the information involved, the safeguards protecting it, and the likelihood it could be misused. Strong encryption and a fast, documented response can make a meaningful difference in that assessment.

If your firm hasn’t reviewed its device security since the last laptop refresh, now’s a good time. Gibraltar works with small and mid-sized law firms across the GTA to build IT security that holds up when a laptop actually does go missing. Reach out to Gibraltar to talk through where your firm stands today.