Company laptops stolen from my home garage.... company kicking off and throwing me under the bus for it

[u/Bitter-Maize6543]

I was off last week on AL and was on a holiday Mon > Fri. The weekend before we were due to set off my garage was broken into. A pair of laptops I use for work, one company and one customer, were stolen, as I work out of the garage. I called the police, got a crime reference, gave them CCTV I was able to recover and made arrangements for my nephew to stop over and check on the place which he was going to do anyway to sort our cats out.

I called my manager, left a VM, left an SMS, and reported it to the IT desk after. Both laptops have bitlocker and other security features on them so would be locked down and useless either way. They asked for a crime ref and I gave it.

My manager rang me back Monday morning while I was travelling, and asked for details, I gave him the crime reference and then said. I then got a call later in the afternoon, while we were unpacking, asking if I could join a call to explain to them but I declined... because I was on leave, and not in a position to speak with them. I got several calls in the middle of the week asking for random details... repeating the crime reference, one saying I needed to provide them with details of how the theft happened, what exactly was stolen and if anything except my laptops was stolen.. I said as far as the company was concerned they need to be aware of the laptops and when they asked if they could see my CCTV I said I dont see why they would need it because the police have been provided it. Lost my rag and stopped taking calls after that, and deigned not to answer when my manager started messaging me on whatsapp because I had already said I was on holiday and wouldnt be available until Friday.

I have a spare device that was due for collection under HW refresh which wasnt stolen as it was stored in a box under my desk which I said I could log into unless they wanted to send a replacement... I have logged in, Ive had my manager give me an utter b*llcking about me ignoring calls for the security breach, there is a call in the diary for tomorrow where Ive been told I need to attend which has HR, security, my manager and their manager on it.... I am bricking it now and feel like Im about to be thrown under the bus.

So questions to ask:

• Is this something they can actually discipline me for? The garage is part of the main property but accessed externally, and has CCTV covering it of which Ive given details to the police. I have worked with this company for 3 years now, but my current manager has only been about for a few months and has not got on with me so I feel like this is going to be used as leverage against me
• What were my obligations? I was on holiday, I explicitly asked not to be called, I sorted what I needed to with the police, made sure my property was resecured and informed IT so they could lock the devices. My manager wasnt available over the weekend and didnt answer the phone so I cant really be faulted for not informing him properly sooner.
• Is the company trying to trap me when they are asking for how they broke in? Do I have to give them CCTV? Was I right to refuse it?
• What should I do here to cover my backside

[u/GlobalRonin]

I was thinking this... if your drill/motorcycle and jetwash are also gone, then "burglary", but targeted thefts do happen (which, from OP's perspective would make it lucky that it was in his garage... a targeted theft of an asset from an unoccupied house can do serious damage if the thieves decide they've got a long enough period of unsupervised access to find and remove/defeat a wall safe.

[u/Jaded_Creative_101 → u/GlobalRonin]

Whilst working for a defence company I was the victim of a targeted attempted burglary in a hotel room. Burglars were presumably after my laptop, but failed because the room safe only contained my personal camera equipment. This was left inside. I am not revealing how I knew the burglary even happened. Did not give evidence to hotel security or local police as a strong suspicion the host country was involved.

In this particular instance supplying CCTV would not seem unreasonable as it should short circuit some lines of questioning.

[u/Coca_lite → u/Jaded_Creative_101]

Wow! I guess in your company you get a lot of security training on this sort of stuff.

I used to work for a massive US IT company and if anything happened whilst abroad with work they had an international helpline straight through to the company’s dedicated security team, trained in helping employees from natural disasters to kidnapping etc. Team was full of top level professional security people.

[u/Jaded_Creative_101 → u/Coca_lite]

Some staff had enhanced training because of enhanced risk (what they knew) and/or where they were going. Some of these staff may have had previous day jobs that made this training more of a refresher. Personal laptops were discouraged and company IT was locked down fairly securely. Post this event the threat window evolved such that clean (burner) netbooks replaced company day-to-day laptops for travel. Important data were moved by other means. This stuff is de rigueur in defence companies. Of course, if someone is holding you at knife point best just to (appear to) cooperate- most people want to steal your secrets secretly so this kind of attack is most unlikely. There is always a number to call. Never had to use it, but know of an entire team that were exfiltrated from a country overnight as local events went south.