P2021-ND-140

An employee?s laptop bag and laptop were stolen in Edmonton, Alberta on or about March 1, 2020. The laptop?s local storage drive does not contain documents or files containing personal information. However, several months of emails are stored locally on the laptop. The Organization determined that some of the emails or their attachments contained personal information. On or about March 28, 2020, the software the Organization uses when a device connects to the internet, contacted the Organization to provide an update on the laptop activities. The Organization ?isolated? the laptop, blocking all network activity and making the laptop useless. The laptop remained online until March 29, 2020. The Organization reported that when the laptop was online, its activity was directed towards removing or disabling the software. The Organization believes the software was successfully removed or disabled. The software logs indicate that the laptop has been powered up several times since it was stolen and that the laptop?s local administrator account has been compromised.
? The laptop has not been recovered.