Stolen Laptop - Next steps

Question

My laptop (modded 2007 Macbook Pro) was stolen 2 days ago when I didn't pay attention to my backpack in a tourist spot in Europe and while I'm quite certain they won't have much use for it (the apple is orange :) I'd still like to make sure I'm thinking of everything. What are the next steps, what can I ignore? This is the situation:

• OS X 10.8, no HDD encryption, no anti-theft measures (Prey etc)
• Accounts: Admin + separate, limited User account with complex passwords, Account names are not pre-filled
• CVs etc with lots of private data, also outside of User folder on 2nd HDD
• Bank Account, FTP, Mail passwords encrypted in KeePass, nowhere as plain text, none connected to birthdays or other (guessable) personal data
• No passwords saved in browsers
• Lots of e-mails with sensitive and other data, contact book etc in User folder (how easy is it to access those?) as well as my .ssh directory
• Just realized: locally stored websites with config files that contain passwords to my server & DB in plain text (!)

Am I thinking in the right direction? Should I change all my passwords? Any guess of the likelihood that a (crappy looking) tourist laptop will warrant any attention or does this not matter at all, because I should just assume worst case anyways?

Thanks a lot in advance!

Answer 1

Chances are they will just whips it and sell it. I would as a countermeasure at least change passwords to your critical data ( bank accounts, servers, passwordmanager). The rest is up to you. However note that the effort would be quite low to change all your passwords compared to the potential damage.

If you have the serial of your Mac computer you could opt to share this with Apple. Not sure if they have an anti theft program, but they could see the device pop up again.

I would advise you to consider full disk encryption next time. Because it would have mitigated all of these risks. Keep pass by default uses aes 256. If your password is complex enough meaning it has numbers upper and lowercase letters as well as signs and has a length of over 12 characters, then you should be fine.

Do consider that there might be cookies on your computer which still have valid session tokens. Keep a close eye on all your accounts and register any suspicious activity. (Often these are still valid after password changes)

Note that even if you would be defrauded then normally the bank or the car company would refund you as to avoid reputational damages to their brand.

Answer 2

Yes - definitely change your passwords. It is a low effort way to fix a lot of potential problems!

It used to be that laptops would be wiped if they had a password on, but the tools to glean data off them are so commonplace/simple now, most attackers will try and see what is on there - as they can make a fair bit of money from account details held on laptops.

Don't assume no passwords are saved - more is saved than you think, as browsers and operating systems try to be helpful.