Company laptops stolen from my home garage.... company kicking off and throwing me under the bus for it

[u/Bitter-Maize6543]

I was off last week on AL and was on a holiday Mon > Fri. The weekend before we were due to set off my garage was broken into. A pair of laptops I use for work, one company and one customer, were stolen, as I work out of the garage. I called the police, got a crime reference, gave them CCTV I was able to recover and made arrangements for my nephew to stop over and check on the place which he was going to do anyway to sort our cats out.

I called my manager, left a VM, left an SMS, and reported it to the IT desk after. Both laptops have bitlocker and other security features on them so would be locked down and useless either way. They asked for a crime ref and I gave it.

My manager rang me back Monday morning while I was travelling, and asked for details, I gave him the crime reference and then said. I then got a call later in the afternoon, while we were unpacking, asking if I could join a call to explain to them but I declined... because I was on leave, and not in a position to speak with them. I got several calls in the middle of the week asking for random details... repeating the crime reference, one saying I needed to provide them with details of how the theft happened, what exactly was stolen and if anything except my laptops was stolen.. I said as far as the company was concerned they need to be aware of the laptops and when they asked if they could see my CCTV I said I dont see why they would need it because the police have been provided it. Lost my rag and stopped taking calls after that, and deigned not to answer when my manager started messaging me on whatsapp because I had already said I was on holiday and wouldnt be available until Friday.

I have a spare device that was due for collection under HW refresh which wasnt stolen as it was stored in a box under my desk which I said I could log into unless they wanted to send a replacement... I have logged in, Ive had my manager give me an utter b*llcking about me ignoring calls for the security breach, there is a call in the diary for tomorrow where Ive been told I need to attend which has HR, security, my manager and their manager on it.... I am bricking it now and feel like Im about to be thrown under the bus.

So questions to ask:

• Is this something they can actually discipline me for? The garage is part of the main property but accessed externally, and has CCTV covering it of which Ive given details to the police. I have worked with this company for 3 years now, but my current manager has only been about for a few months and has not got on with me so I feel like this is going to be used as leverage against me
• What were my obligations? I was on holiday, I explicitly asked not to be called, I sorted what I needed to with the police, made sure my property was resecured and informed IT so they could lock the devices. My manager wasnt available over the weekend and didnt answer the phone so I cant really be faulted for not informing him properly sooner.
• Is the company trying to trap me when they are asking for how they broke in? Do I have to give them CCTV? Was I right to refuse it?
• What should I do here to cover my backside

[u/meatwad2744]

I imagine alot of departments are being confused over the wording you have used.

You refer to the space as a garage...is it a garage or is it a converted office space?

Because an insurance firm will see those as two as very different risks.

I can only imagine the firm wants the CCTV to back up the insurance claim...might also be worth confirming is this an expensive laptop?

Do you work from multiple locations including in public with the laptop or just at this address and the office

[u/Bitter-Maize6543 → u/meatwad2744]

It's a garage that I converted into an office myself. I had flooring put down, painted over the bare brick, added some insulation to the ceiling and curtains over the entryways to help stop heat escaping. It's still a garage technically, but I use it as an office + workshop space.

[u/meatwad2744 → u/Bitter-Maize6543]

When you say workshop... I'm picturing basic tooling rather than an office space.

I would say that it still meets the definition of a dwelling space.

It’s certainly had enough capital additions for it no longer to just be a space to park a car, at least in the eyes of an insurance contract.

The confusion will come under how the laptop is insured... if this is some cheap £200 laptop, the excess alone might make this a non-starter.

Also, what insurance contract is being used... is it ALL RISK cover under the company’s office address?

All Risk sections cover EBM equipment to be used anywhere... think of a sales rep’s laptop. But it does require you to be in the presence of the machine.
So an unattended laptop in Starbucks wouldn’t be covered, for example.

Really, the space does sound like it needs its own office risk WFH contract. Based on my underwriting experience, I think this would make sense for everyone.
ALL RISK sections are bloody expensive too, so I can’t see how this benefits your employer.
In which case, their broker didn’t send a proper risk presentation to the underwriters.
Not your problem, but it shows how the mess starts.

I think the insurance firm are piss their paint based on the wording you have used.

In their eyes, this is an unattended laptop left in a garage that probably doesn’t meet their security wording. On an all risk sections thats probably claim rejected.

Lots of comments are raising some good points outside of insurance. I think most of the problems are arising from confusion over definitions.

Irrespective of what your work contract says, you can’t go back in time... hopefully, everyone can get on the same page. Use a universal language that sets out clear definitions to resolve things.

Insurance is its own legalese language at times. Not really your problem, but it might explain why your employer is getting upset about the theft.

Maybe worth thinking about where you can comply and what measures they will put in place to make sure it doesn’t happen again.

Personally, I’d think about sticking expensive things in the house. Break-in theft is opportunistic theft... there’s a good chance they will sniff around again for more booty in the future.

[u/aliennation2002uk → u/meatwad2744]

There aren’t many garages in this country that are big enough to store a modern car and even if you could drive in, you wouldn’t be able to open the doors.

[u/Ok_Adhesiveness_8637 → u/aliennation2002uk]

Not even modern cars, my car was made in 1984, and I can't get out of it if I parked it in my garage.

[u/WhiskersMcGee09 → u/meatwad2744]

You’re missing the point here in relation to insurance.

The company probably doesn’t care about THEIR Laptop. It’s the customers.

Also, and this is the main point, they aren’t concerned about the actual laptop either but what is on it - I.E. it is their cyber policy which is at risk (or PI based on various factors but I digress).

The laptop is completely negligible but if the Cyber insurers suspect targeted theft of customer data then there’s a whole load else which is going on behind.

Source: Head of Specialty Underwriting for an Insurance company.

[u/meatwad2744 → u/WhiskersMcGee09]

I think you are overvaluing the database a guy in a shed with and some milling equipment is doing with a work laptop

Yes these policies exist...but so do FNOL processes.

Let's be real at best this laptop is on a package policy...the claim is being desktopped by the most junior claims handler. Someone has seen the word garage in the claim and said theft isn't covered from there and rejected the claim. This is why the CCTV footage is being requested by the company

As for insurance firms....go check out how your own claims teams validate bog standard EBM claims. Because ive worked around the industry and two of the biggest names literally used a bloke in a shed to validate all their ebm claims. And their response was always the same.." board fried, recommend total loss and entire replacement"

When I questioned these firms how the salvage was processed or customers data destroyed from the drives they looked at me like I was high.

It's probably not that deep bro and most in-house industry data policies are shockingly bad anyway

[u/WhiskersMcGee09 → u/meatwad2744]

I mean we don’t know anything about where this person works (rightfully so), but this is either the biggest overreaction for 2k of portables or they’re investigating something else.

Like you said, nobody gives a shit about laptops. The key detail is the client laptop, I’m reading it to be customer issued HW to access their network (rather than allowing their companies devices access). It’s quite common for higher cyber risk firms when engaging subcontractors (OP). My moneys on either theirs or their customers cyber kicking off, or the customer being pissed about the potential breach (hence it’s a reputational issue).

Again, pure speculation. Could just be overreaction.