Security of files if my MacBook is stolen

chaure wrote:

1. MacOS Sonoma 14.1

Unencrypted Disk

Login Password: xxxxREDACTEDxxx

My car was broken into and my laptop bag was stolen. As you can see above, the security was not too great. I've enabled "Lost Mode", but most thieves today anyway know that they should not connect to the Internet.

highly unlikely...

You do not say what exact mac this is...

A Mac or another model with an Apple T2 chip or SoC M1/M2/M3, the data on your drive is already encrypted automatically. Independent of all the additional layers of filevault, firmware....

If you have a password protected login— the likelyhood of access is limited.

If your Mac is lost or stolen - Apple Support

About Startup Security Utility - Apple Support About Startup Security Utility on a Mac with the Apple T2 Security Chip - Apple Support

A Mac with Apple silicon uses the sophisticated security features to protect your Mac against malicious tampering. By default, your Mac uses the highest level of security

Find My - Official Apple Support

chaure wrote:

I'm assuming that somebody can remove the HD and connect it via lightning to read all the contents.

That would depend on the exact model / year of Mac you have.

Unless its an older Mac, the HD is not removable part in Macs and has not been for a few years now.

Edit: The 2019 MBPs do not have removable drives. They are soldered onto the Logic board. and as mentioned the data is already encrypted. without your password even if weak, they cannot access any data.

All the below is not applicable to your model of Mac.

If yours is still the removable kind, and the thieves are so inclined they would be able to access your data through an external enclosure, but unless you are a high profile target with data they are already looking for, in most cases, they just want to sell the computer for a profit, not rummage through personal data.

Also, lightning is a port on iPhones and iPads, nothing to do with Macs. They can connect the drive via USB though.

1. Once they connect the HD externally, will they automatically have access to all the Documents in the iCloud folders as well? I have copies of the passports in there, license copies that I was using in the last 3-4 days for some work.

They can access all folders and locally stored data including iCloud files. Though the location of these is not really accessible directly from a different Mac, they would really really want to go through your data to look into the icloud folders which are stored in other locations deep in the folder structure of the macOS operating system, not in your user profile directly.

2. I use MS Outlook macOS for work. Will they be able to read all the data till time stolen even though there is no active SMTP connection?

Again they can, but they would need to go into Outlook's data folders to access your email. They can't just open the Outlook app from a different computer and automatically see your email.

Just to be extra clear, 2019 MacBook Pros do not have removable drives. They have a collection of flash storage chips soldered onto the logic board.

It's irrelevant to the situation. A T2 Mac or an Apple Silicon Mac is always encrypted. If the drive is removed, no matter how, it will be encrypted and unaccessible.

Whether or not the drive is soldered onto the logic board is an irrelevant bunny trail.

The fact that the password is trivial is the only issue. The bare drive is secure.

I never leave any valuables in the passenger compartment of my vehicle when I am not in the car as thieves only need a few seconds to break in and steal stuff. Instead, the laptop goes in the trunk before I leave home if I know I am going somewhere that I need to leave the vehicle, or it goes with me outside of the car. That way, no one sees me put the laptop in the trunk at the destination.

If you were using an easily guessed or cracked password, and you had financial and other password data in plain text on the laptop, assume it has been compromised and you need to contact your financial institution and change passwords on any accessible accounts. Identity theft is a royal PITA to resolve.

Just to be extra clear, 2019 MacBook Pros do not have removable drives. They have a collection of flash storage chips soldered onto the logic board.

There's no way they can remove them, without major surgery, and no way to put them into anything but a similar Mac with a lot of very precise soldering work.

Unlikely any run of the mill thief out there has either the expertise, monetary resources, nor the inclination to do that, to maybe access something that for all they know could be worthless photos of cats.

chaure wrote:

I got Lifelock immediately to monitor any changes.

Not to make a bad day worse but.... Do you even want to know how many times Lifelock has had their user data hacked?

Check with your credit card companies. At least one of mine, Discover, if I recall, does some identity theft prevention/warnings at no cost.

chaure wrote:

To stop being cryptic, I had changed my login to my first name just the previous night to make it easier for my work. That's when this happens. Since my entire laptop bag was stolen with my business cards and other work documents, a slightly above average person might take a shot at trying some password combos. That's what I am worried about. And BTW, I am a small business owner, so my business documents are also on it.

I doubt the thieves want your data. They likely want to sell the Mac. Use Find My to erase it and render it useless.

chaure wrote:

Its like closing the barn gates after the horses have bolted. Every major company gets hacked for user data. But something is better than nothing.

My point is that there are more trustworthy and less costly ways of getting protection than Lifelock. They are familiar to most people because of their scaremongering ads. But, you need to do what makes sense to you.

https://securityplanner.consumerreports.org/tool/get-help-with-identity-theft

Are you saying you have no login password? If that is true, they can just open it and get to everything. There is no reason to remove it from the Mac. If you have a password set, but have enabled automatic login, then they can also get to everything by opening the Mac.

If they were to remove the drive from the Mac, it would be encrypted. There is no way they could view the data.