Reporting lost or stolen data media, computing devices,
or smartphones

What to do first

Please read the following, then fill out the Information Security Office Lost/stolen electronic media or computing device form and send it to security@yale.edu.

There are a number of other important steps you'll need to take. The form includes these steps and this web page can be used to help you navigate the requirements in the form and the necessary steps you should implement.

IMPORTANT: DO NOT CANCEL YOUR SERVICE FOR THE PHONE UNTIL ALL DATA HAS BEEN SECURELY REMOVED.

1. Report the loss

Notify local law enforcement in the jurisdiction where the laptop was stolen (e.g. Yale Police Department, the local police in other locations). Be sure you get the case number and primary police contact for the case.

IMPORTANT: DO NOT CANCEL YOUR SERVICE FOR THE PHONE UNTIL ALL DATA HAS BEEN SECURELY REMOVED.

2. Contact the Information Security Office

Provide the Yale Information Security Office with the Yale Police case number and contact information. You may also want to contact your IT support provider.

3. Determine if you lost confidential or sensitive data or data belonging to another organization

In order to document whether or what confidential/sensitive data may have been exposed, consider what kind of information was stored on your computer or device. If you have an ITS network backup account or a backup CD or DVD, you can review the information stored by reviewing the backup. Determine if any data belonging to other organizations, corporations, or agencies (e.g. Federal, state or non-profits such as the VA or Yale New-Haven Hospital) were stored on the device.

Determine if any legally protected, contractually restricted, or Yale confidential information was stored or handled on the computer or device. If so, notify these entities. If you believe that any sensitive data existed (e.g., personal medical or health data), personal financial information, credit card or banking account numbers, Social Security numbers), notify the Yale Information Security Office IMMEDIATELY at security@yale.edu.

4. Change your passwords

Change passwords you believe may have been used, stored, or saved in memory on the computer or mobile/storage device. You can change your Yale NetID password at any time.

5. Notify credit cards and banks

If you stored any confidential data, such as credit card or bank account numbers on the computer or mobile/storage device, you should notify the affected institutions. See Resources if you think your identity may be compromised.

6. Contact S.T.O.P.

If the computer or device was registered with the Yale University S.T.O.P. program (Security Tracking of Office Property) provided by the Yale Department of Security. STOP isn't a tracking device like LoJack, but is an identification plate that is permanently affixed that prominently labels the laptop as Yale property.

• The phone number to call regarding the service is 1-800-488-STOP
• The Yale Security staff person responsible for the program at Yale is David Landino

7. Contact CompuTrace LoJack if you are registered

If you enrolled your device in one of their programs, such as Absolute Software's Computrace LoJack for Laptops. You'll need a police report to activate the tracking service.

8. Register the computer's information

Register the information with the National Stolen Computer Registry. You'll need to provide your computer's serial number. Your computer vendor may also have a registry that allows you to report the computer as stolen.

9. Faculty and staff members should notify their business manager of the loss

All computers registered for access to the Yale network have a unique Ethernet address number that is recorded by ITS when your computer is registered. It is possible that the computer might be found if it is re-connected to the campus network, using the Ethernet Hardware Address (also known as a "MAC address") of the device. See your department Distributed Service Provider (DSP) for information on your computer's Ethernet Hardware address. You can also call or email the ITS Help Desk, at 203-432-9000.

10. Remotely remove all data from a mobile device

In the event your device is lost, stolen, or being repurposed you can remotely remove all data from the device.

11. Fill out the lost/stolen electronic media or computing device form

Fill out the lost/stolen computer form and then send the form via email to the Information Security Office, at security@yale.edu ASAP.

12. Report the loss to the Yale Office of Risk Management

Please complete the Property Claim form to report the loss. All forms must be submitted within 24 hours of the incident.

 

Other considerations

It also may be the case that if the computer or device is configured to automatically login to a service (such as email) at Yale (no matter where it is physically located), that we may be able to establish a location for the stolen device. If you have any questions or concerns, please feel free to contact us at security@yale.edu.

 

Requiring minimum security (no secure data stored locally)	Requiring most security (Ephi, HIPAA, single source, financial data, confidential info)
Laptops docked (home and office only) S.T.O.P. Program Security cable Locking screen saver	Laptops docked (home and office only) S.T.O.P. Program Security cable Locking screen saver Backup service Computrace
Laptops mobile (always on the move) S.T.O.P. Program Security cable Locking screen saver BIOS level password	Laptops mobile (always on the move) S.T.O.P. Program Security cable Locking screen saver Backup service Computrace Password organizer
PDA and smart phones S.T.O.P. Program BIOS level password	PDA and smart phones S.T.O.P. Program BIOS level password Password protection w/data destroy options

---

Related topics

• Information for Yale systems administrators on intrusion recovery
• Yale's Information Security Office