Laptop Loss and Theft Statistics (2026): What the Data Shows

Search for laptop loss statistics and the same few numbers turn up again and again: 12,000 laptops a week lost at US airports, $49,246 for every lost laptop, one stolen every 53 seconds. Most of them are more than fifteen years old. Several were paid for by companies selling encryption or locks. At least one can't be traced to any published study at all.

This page goes back to the original reports. Every figure below links to the document it came from, gives the year it describes and, where it matters, says who paid for it. Where the evidence is thin I say so rather than padding it out.

Headline numbers at a glance

Read the old numbers with care

The most quoted laptop figures come from three Ponemon Institute studies published between 2008 and 2010. Ponemon is an established research firm and published its methods, which is more than most statistics pages can say. But the sponsors were Dell and Intel, and the 2010 study landed months after Intel agreed to buy McAfee, as The Register noted at the time. The sponsors sold the very protections the reports recommended.

None of that makes the numbers wrong. I would still ask three questions of any of them before putting it in a business case.

1. How old is it? A 2008 figure describes laptops, storage habits and airport security procedures that have since changed considerably.
2. Who paid for it? A study sponsored by a lock or encryption vendor is not automatically biased, but its framing usually favours the product.
3. Is it a count or an estimate? Several famous figures are extrapolations from estimates, not tallies of reported incidents.

What a lost laptop actually costs

The cost of a missing laptop comes in three layers, and they scale very differently.

The data layer dominates, when it applies

The often-repeated $49,246 per lost laptop comes from a 2009 Ponemon study sponsored by Intel, built from 138 cases of missing laptops at 28 US companies. The Register's write-up of that study reports that about 80% of the average cost came from data compromise, not hardware. An encrypted laptop cost about $40,000 on average, against about $60,000 for one without encryption. So encryption made a real difference, yet in 2009 it still did not make a loss cheap.

For a current reference point, IBM's Cost of a Data Breach Report 2026, researched by Ponemon, puts the global average breach at $4.99 million, a 12% rise on the year before. A summary by Baker Donelson gives the US average as $11.5 million, from 602 breaches between March 2025 and February 2026, and notes that 53% of breached organisations had unencrypted data. These figures cover every kind of breach, most of them network intrusions. They tell you what a breach costs once it happens. They say very little about what a typical missing laptop costs.

The time layer is the one you'll definitely pay

Even a well-protected device costs time. TechSpot's report on the 2010 Intel-sponsored study says only 29% of the lost laptops had been backed up and 30% had disk encryption. Work that existed only on the machine went with it.

Worked example (hypothetical)

These are illustrative assumptions, not sourced averages. Take a business laptop with a replacement cost of $1,400. IT spends three hours wiping access, provisioning and enrolling a replacement at an internal cost of $60 an hour, so $180. The employee loses a day and a half of productive work at $55 an hour, so 12 hours and $660. That is about $2,240 before anyone asks what was on the drive.

If the device was encrypted, the loss was reported the same day and access was revoked, that may be close to the full bill. Otherwise the data layer decides the cost. You can run your own figures through the cost of lost equipment calculator, and there is a longer breakdown in the real cost of lost equipment.

Where laptops go missing

Mostly outside the office

The 2010 Ponemon study, sponsored by Intel, surveyed 329 US organisations that between them lost 86,455 laptops over a 12-month period. Intel's published summary says 43% were lost off-site, working from a home office or a hotel room, 33% in transit or travel, and 12% in the workplace. Out of an average of 263 lost laptops per organisation, just 12 were recovered. Education and research had the highest loss rates, followed by health and pharmaceuticals, then the public sector.

Airports: where the 12,000 a week figure comes from

The airport figure comes from Airport Insecurity: The Case of Lost Laptops, a Ponemon study sponsored by Dell and dated 30 June 2008. Researchers collected weekly estimates from 106 airports in 46 states and added them up: 10,278 a week across 36 of the largest airports and 1,977 across 70 others, 12,255 in total. The Ponemon press release rounded that to up to 12,000 a week and up to 600,000 a year.

Read the footnote, though. The report itself says the frequencies were either a direct weekly estimate or a range given by airport officials, and that exact loss frequencies were typically not calculated or available. Where the study is useful is on the places people get separated from their laptops. Airport representatives named security checkpoints (40%) and departure gates (23%) as the most common places, followed by restrooms (9%). Only 33% of laptops that were found were reclaimed.

The figure was challenged almost immediately. Network World reported that Miami International logged 480 laptops turned in to lost and found for the whole of 2007, against the study's estimate of 1,000 a week, and that the TSA put the national figure at about 75 laptops reported lost or missing a month. Larry Ponemon's answer was that the estimates captured temporary separations, such as a laptop left at a restaurant and collected minutes later, which never reach official statistics. Both things can be true. I'd use the number only as evidence that checkpoints separate people from laptops, and never as a count of laptops that vanished.

Cars, offices and restaurants

A 2016 Kensington survey of US IT professionals found that 25% of IT theft happened in cars and transport, 23% in the office, 15% in airports and hotels and 12% in restaurants. It also found 34% had no physical security policy for laptops and mobile devices. Kensington makes laptop locks and does not publish the sample size on that page, so treat this as a directional finding: the office is not the safe zone it feels like.

What current breach data says

Verizon's 2026 Data Breach Investigations Report counts 525 incidents in its Lost and Stolen Assets pattern, 88 of them with confirmed data disclosure. Verizon describes the pattern as mostly insiders losing track of their own devices, roughly four times more likely than theft by financially motivated thieves. Personal data was involved in 96% of those breaches.

Incidents in this pattern rose sharply, but only 17% were classed as confirmed breaches, against 82% in the 2025 report. Verizon suggests part of the reason may be that victims could not confirm whether data on the lost device was accessed. A large share of lost-device cases now end in uncertainty, and removing that uncertainty is the whole job of good records and encryption.

What regulators see

United States: HHS breach reports

US healthcare organisations must report breaches of unsecured health data to the Department of Health and Human Services, which makes HHS one of the few public sources that classifies breaches by type. Its Annual Report to Congress for 2024 received 663 reports of breaches affecting 500 or more people. Theft of electronic equipment, portable devices or paper accounted for 16 of them (2%) and loss for 2. Laptops were the location of the data in 9 large breaches affecting 76,431 people. Among the 74,299 smaller breaches, there were 2,593 loss reports and 822 theft reports, and laptops were the location in 229.

The same report lists adopting encryption among the steps organisations most often took afterwards, which makes sense given the rule. HHS guidance says electronic health data encrypted in line with NIST Special Publication 800-111 is rendered unusable to unauthorised people, so a lost encrypted laptop generally does not count as a breach of unsecured data.

United Kingdom: ICO incident data

The ICO publishes every personal data breach report it receives as a downloadable data set. Its category for laptops is “loss/theft of device containing personal data”, which the ICO glossary defines as a laptop, phone or tablet holding other people's personal data that has been misplaced or stolen. Counting unique incident references in the data set gives the following.

In 2025, education and childcare filed the most device loss reports (36 of 154), followed by the charitable sector (21) and health (17). That lines up with the 2010 finding that education had the highest loss rates. There is more on why schools and universities struggle in our guide to school equipment management.

Organisations should enable storage encryption on laptops, phones and tablets that hold personal data, according to the ICO's own encryption guidance. That guidance cites the £150,000 fine issued to Glasgow City Council in 2013 after two unencrypted laptops were stolen from council offices, one holding data on 20,143 people. The investigation found around 74 more unencrypted laptops unaccounted for, and the enforcement notice required an IT asset audit, asset management training for managers and an up-to-date asset register. As far as the regulator was concerned, knowing where your laptops are was part of data protection.

Under GDPR, Article 34(3)(a) removes the duty to tell affected individuals about a breach when the data was protected by measures that make it unintelligible, such as encryption. The likeliest reading of the falling share in the table is that more lost devices are encrypted and never need reporting. The data cannot prove that, since it only counts what was reported.

The remote and hybrid angle

Company laptops increasingly live at people's homes. In Gallup's hybrid work indicator, as of May 2026, 52% of remote-capable US employees work hybrid, 26% work exclusively remotely and 22% work on-site. In Great Britain, the Office for National Statistics found 28% of working adults hybrid worked between January and March 2025.

The off-site risk was already the biggest one in 2010, when 43% of lost laptops went missing from home offices and hotel rooms. Hybrid work adds two things to it. Devices travel between home and office far more often, which is the in-transit exposure the airport study described in miniature. And the riskiest single moment shifts to when someone leaves: a laptop that sits in a home office after the last working day is not lost in any dramatic sense, but nobody can say where it is either. There is more on handling that in managing equipment for remote and hybrid teams and on our hybrid and remote industry page.

What reduces loss, and what reduces the cost of a loss

The research points at two separate jobs. One is keeping track of devices, so fewer go missing and the ones that do are noticed quickly. The other is making sure a missing device does not become a data incident. Most organisations fund the second and leave the first to a spreadsheet, which is backwards: you cannot protect a device nobody has noticed is gone.

Keeping track

• A custody record for every device. Who holds it, since when, and their signature or acknowledgement at handover. The 2010 study logged most losses as just 'missing', which is what happens when nobody was formally responsible.
• A recorded return. Leavers and role changes are where devices drift. Recover equipment as part of offboarding, not weeks later.
• Regular counts. A cycle-count audit that asks each holder to confirm or scan their device finds the ones that went missing quietly. Our guide on how to do an asset audit covers the method.
• A written policy. Kensington found 34% of IT teams had no physical security policy. State who may take devices home, how they travel and how fast a loss must be reported.

Limiting the damage

• Full-disk encryption. Both the ICO and HHS treat it as the control that separates a lost device from a reportable breach.
• Mobile device management. MDM tools can lock or wipe a device remotely and enforce encryption. They manage the device's configuration rather than who is responsible for it, so they complement a custody record rather than replace it.
• Backups or cloud storage. These cut the time layer, because the replacement is productive in hours rather than days.
• Fast reporting. A loss reported the same day can be locked, wiped and, if necessary, notified within deadlines. One reported a month later cannot.

Custody records are the part Stackroom covers: each device is issued to a named person with a signature, returned with a signature and its condition, and an assignment closed because the item was lost or stolen keeps the holder on record. Audits mark each item verified or missing. It is not MDM; you would run both. Our piece on why company equipment goes missing goes through the failure points in more detail.

Statistics we left out

Two widely repeated claims did not make the table. The first is that a laptop is stolen every 53 seconds, usually attributed to Gartner; No Gartner publication can be found behind it, so it is not repeated here as fact. The second is a set of 2014 Kensington survey figures quoted on many security blogs; The original survey is not publicly available, only second-hand summaries. If either primary source surfaces, the numbers may well hold up; until then, treat them as unverified.

Sources

• Airport Insecurity: The Case of Lost Laptops, executive summary — Ponemon Institute, sponsored by Dell, 2008
• New study reveals up to 12,000 laptop computers lost weekly in U.S. airports — Ponemon Institute, 2008
• Do 12,000 laptops go missing each week at U.S. airports? — Network World, 2008
• Ponemon and Intel Cost of a Lost Laptop study coverage — The Register, 2009
• The Billion Dollar Lost Laptop Problem — Intel, research by Ponemon Institute, 2010
• Intel reveals the billion dollar lost laptop problem — The Register, 2010
• US companies losing billions of dollars on lost laptops — TechSpot, 2010
• Kensington survey data on where IT theft occurs — Kensington, 2016
• 2026 Data Breach Investigations Report — Verizon, 2026
• Cost of a Data Breach Report 2026 — IBM, 2026
• Ten takeaways from IBM's 2026 Cost of a Data Breach Report — Baker Donelson, 2026
• Annual Report to Congress on Breaches of Unsecured Protected Health Information, CY2024 — HHS Office for Civil Rights, 2024 data
• Guidance to render unsecured PHI unusable, unreadable or indecipherable — HHS, current
• Data security incident trends and data set, Q1 2019 to Q4 2025 — Information Commissioner's Office, 2019–2025 data
• Data security incident trends glossary: incident types — Information Commissioner's Office, current
• Encryption and data storage — Information Commissioner's Office, current
• GDPR Article 34: communication of a personal data breach to the data subject — gdpr-info.eu, current
• Global indicator: hybrid work — Gallup, 2026
• Who has access to hybrid work in Great Britain? — Office for National Statistics, 2025