When the Leased Laptops Went Back, the Data Went With Them
Three hundred and forty laptops came off a three year lease last spring. A logistics firm collected them over four days, signed a manifest, and returned them to the lessor. I signed the manifest myself and thought no more about it until an auditor asked a direct question: where is the certificate confirming those machines were wiped, and what does it say? There was no certificate. The lease…
In a recent incident, 340 laptops returned from a three-year lease created a data security concern for a company. A logistics firm handled the collection and return process, but the audit revealed a critical gap in data sanitization. The company's auditor questioned the presence of a certificate confirming the laptops had been wiped clean, to which there was no response.
The original lease agreement only promised sanitization, leaving the specifics undefined. The company's chain of custody for the devices was well-documented, but there was no safeguard for the data that remained on the machines. Concerningly, 28 devices were never returned and were billed as losses, potentially leaving 28 unencrypted disks vulnerable.
The company also had a surplus of old equipment, kept for emergency use, but nothing was done to protect the data on those devices. The company's approach to disposing of assets was lacking, with data leaving the premises only during disposal, which is the least-secured stage of the asset lifecycle. The company has since changed its procedures to sanitize equipment in-house before it's collected, verifying and recording each device by its serial number.
This includes all storage devices, like printers and network equipment, to ensure comprehensive data protection. Lost devices are now reported as security incidents rather than financial adjustments. The company learned a valuable lesson about the importance of securing data throughout the entire asset lifecycle.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
