stolen macbook air

If you have a Mac with Apple silicon or an Apple T2 Security Chip (2018 or later), your data is encrypted automatically. Turning on FileVault provides an extra layer of security by keeping someone from decrypting or getting access to your data without entering your login password.

Was the disk encrypted with FileVault? I would recommend that, especially for laptops.

Protect data on your Mac with FileVault – Apple Support

Do I need to worry that someone can still access the data on the hard drive please? Can they just remove the hard drive and access the data elsewhere?

Your data is safe, in the sense that it is encrypted. Your Mac isn’t useable by anyone else (if you have a strong Mac user password that the thief doesn’t know). Resetting the user account would require an (online) TFA confirmation from you (which you can deny). The theft is quite ignorant; it would never work as they intended.

➔ If your Mac is lost or stolen - Apple Support

Adding to what Urquhart said, in a M2 Mac, the storage is solid-state and soldered onto the logic board, so there's no way someone could remove it to try and get access to your data. So while we can't say it's impossible someone could get access to your data, it's very difficult. I would still suggest that you change passwords to any of your online accounts, particularly for banks or other financial services, as a precaution.

Regards.

Sicin wrote:

MacBook Air M2 2022

OS 14.6.1

Log in password enabled

Had my MacBook Air stolen yesterday. Details as above. I have changed Apple ID password, and have put erase on Find My.

Do I need to worry that someone can still access the data on the hard drive please? Can they just remove the hard drive and access the data elsewhere?

There is no hard drive in a M2 MacBook Air. There is a solid-state drive (SSD). The SSD consists of one, or more flash chips soldered to the motherboard; and a SSD controller that is part of the M2 processor.

Most or all of the contents of the SSD are encrypted, using encryption and decryption keys held inside of the M2. The fact that the flash chips are soldered in would be enough to prevent most people from "pulling the drive", but should someone have the skills to remove the flash chips without damaging them, and put them on another board, they would find that the data stored on the chips was so much unintelligible hash.

The only real chance someone has of accessing your data is if the flash chips are still in the M2 MacBook Air – and they can get around your login password somehow, e.g., because

• The Mac was unlocked when they stole it
• The Mac was set up to automatically log in on power up
• You used a login password that was easy to guess
• You used a login password that was hard to guess, but the thief had a chance to learn it.

Sicin wrote:

Had my MacBook Air stolen yesterday. Details as above. I have changed Apple ID password, and have put erase on Find My.

…

No location found as expected. Think most know not to log onto any internet.

That's a likely explanation - that the Mac has not had an opportunity to report its location.

There is another. You said that you requested a remote Erase. This works a little differently on Macs than it does on iPhones. On iPhones running a recent enough version of iOS, the phone is theoretically trackable even after getting an Erase request. But an erased Mac "cannot be located or tracked any longer" – "you won't be able to find it using Find My."