The firm
A mid-sized Melbourne law firm. Family law, commercial disputes, some estates work. Between them the partners hold the kind of files where the contents are not merely confidential but privileged, and where a disclosure is not just embarrassing, it is a professional conduct problem.
They came onto the managed security service the year before, after an insurer started asking questions at renewal that nobody could answer with a straight face.
16:34. The car park
A partner finished a client meeting in the city, put her laptop bag in the boot, and walked around the corner for twenty minutes. When she came back the boot was open and the bag was gone.
The laptop had her mail, her matter files synced locally, and a browser signed into the practice management system. She stood in the car park and did the arithmetic on what that meant, and it was not a good sum.
16:41. The call
This is the part worth paying attention to. She did not email anybody. She did not open a ticket. She rang the priority line, which is a number issued to every client at onboarding and lives on a card in their wallet for exactly this reason.
A Ferres Systems responder picked up and confirmed it on the call: a stolen laptop with live sessions into privileged client files is a priority-one incident. The 30-minute clock starts at confirmation, and here confirmation happened with a responder already on the line, so it was handled from the moment it was confirmed.
16:44 to 17:00. Sixteen minutes of work
The times in this file are what happened on this call, not a promise about every incident. The commitment is that a priority one is handled within 30 minutes of confirmation. Containment starts straight away and takes as long as the incident needs; a single lost device with the controls already in place is one of the quicker ones.
The responder worked the list in order of what an attacker could do soonest. First, what was done:
- Revoked her sessions. Her Microsoft 365 sign-in sessions were revoked, so the laptop has to sign in again before it gets back into her mailbox. Revocation reaches most connected apps quickly, but applications manage their own session tokens, so it is not a guarantee that every app session ends that minute. That is why the sign-in log below matters.
- Reset her password and re-enrolled her multi-factor on a new device, so she was not locked out of her own working life over the weekend.
- Issued a remote wipe and marked the device non-compliant, so conditional access refuses it if it tries to sign in again.
Then, separately, what was confirmed:
- The disk was encrypted. The device record showed BitLocker on, with the recovery key held in the tenant rather than on a sticker under the keyboard. That had been set at onboarding and checked at every quarterly review since.
- The wipe was pending, not complete. A wipe request runs when the device next connects. At 5:00pm the laptop had not connected, so the wipe was issued but not confirmed, and the write-up said exactly that.
- No new sign-ins. The sign-in log for the account and the device, before, during and after the theft, showed nothing new.
By 5:00pm her old password no longer worked, her sessions had been revoked, a wipe was waiting for the laptop to reconnect, and the disk it would have to be read from was encrypted.
The question the firm actually needed answered
Not “is the laptop gone.” It was gone. The question was whether the firm now had to tell anybody.
That is where the sign-in log mattered. It showed no authentication attempt from the device after 16:12, when she had closed the lid in the meeting. Nothing tried, nothing failed, nothing succeeded. That indicates the laptop had not been used to reach her mailbox or files online. On its own it says nothing about the files synced to the laptop itself, which is where the encryption mattered: a BitLocker-encrypted disk, with the recovery key held by the firm, is not practically readable by someone who has only the hardware and not her credentials. Together, and with the wipe still to be confirmed when the device connects, that supports a reasonable conclusion that no data was accessed.
The write-up went to the managing partner that evening, in the plain English every write-up is done in, and it said so in a paragraph they could hand to their insurer, their professional indemnity broker, or a client who asked. It also said the honest part out loud: this is an assessment based on the evidence available, not a guarantee, and here is exactly what the evidence is.
They did not need to notify. Not because we said so, but because the controls that were already in place made the answer defensible.
What changed afterwards
Two things, neither dramatic.
The firm moved its matter-file sync to on-demand rather than full local copies, so a lost device carries less. And the priority line card, which some staff had filed somewhere sensible and forgotten, got reprinted and handed out again at a team meeting, because the whole outcome above turned on somebody knowing what number to ring while standing in a car park.
The commitments underneath this story
The details above are a composite and the identifying details are changed. The commitments are not: a priority line issued to every client on the managed security service, a named Ferres Systems responder picking up a confirmed priority-one incident within 30 minutes of it being confirmed, at any hour, with initial response and containment included in the plan, and a write-up that answers the notifiable-breach question in language you can forward to anyone who asks.
A stolen device is far less of a crisis when the controls underneath it were set up beforehand. If you want to see how the rest of it runs, the Managed Security page walks you through one night on the service, and there is a case file from an accounting firm that never involved a phone call at all.
