I had an employee provide a resignation before I was on site. The employee then unplugged a desktop computer and left the premises with it. The computer contained pricing data, customer data, email communications, login credentials to several important websites, login info to vendor websites.
I filed a police report and the police were able to recover the computer, however the data on the machine was wiped or the drive was replaced.
What should I do?
I should press charges and contact your insurance company. If it was just a wiped drive, your insurance company may cover data recovery services. They should also be advised due to this being a data breach. You may also want to contact your attorney for additional advice on how to proceed with both the former employee and the data that they potentially stole. Until you have the drive analyzed, you don’t know if it’s a replacement. They may have kept a copy of the data before wiping the drive or if they swapped out the drive for a new one. In the case of the latter, they very well may have retained the drive.