Colleague accessed my computer: what to do

MacWindowsUpdated

If you think a colleague got into your laptop, check what you can, write down what you noticed and when, and report it through IT or HR rather than confronting them. Then change your passwords, sign out devices you don't recognise and lock your screen whenever you leave your desk.

Quick answer

Write down the date, the time you were away and what looked different. Don't tidy anything up first. Check the laptop and your accounts for activity you don't recognise, then tell IT, and HR if it's about a person's behaviour. Change your Mac or Windows password and your account passwords, log other devices out, and lock the screen every time you step away.

What should I check first?

Start with the things you can check in a few minutes without changing anything. The laptop itself keeps some records of recent files, apps and sign-ins, and your online accounts keep their own. We've written those steps up separately, so this guide doesn't repeat them:

  1. Recent files, apps and browser history: see how to tell if someone used your laptop.
  2. Sign-in records on Windows and a Mac: see how to see who logged into your computer.
  3. Your work account's sign-ins: if your workplace uses Microsoft 365, sign in at the My Account page with your work account and choose Recent Activity. Microsoft says to expand each sign-in and check you recognise it.
  4. Your Apple Account: on a Mac, choose Apple menu > System Settings, click your name, then scroll down to see the list of devices signed in to your Apple Account. Apple says you can remove a device you don't recognise.

One thing to keep in mind. If the laptop was left unlocked, whoever used it was already signed in as you, so a sign-in log may show nothing new. That's normal, and it doesn't mean nothing happened.

How should I record what happened?

Keep a short, factual note while it's fresh. You may need it for IT, for HR, or later for a complaint, and the people looking into it will want dates and specifics rather than impressions.

  1. Write the date, roughly when you left your desk and when you came back.
  2. Note exactly what you noticed: a file open that you'd closed, a browser tab you didn't open, a message marked as read.
  3. Leave the laptop as it is. Deleting history or closing things can remove the very records IT would look at.
  4. Keep copies of any emails or messages about it.

Describe what you saw, not who you think it was. If it goes further, the facts will matter more than the suspicion.

Who do I report it to?

On a work laptop, tell IT first. The laptop belongs to your employer, and IT has tools and records you don't. If the concern is about how someone behaved, HR or your manager is the right place, and IT can still help with the technical side.

There are also routes outside work, through the ICO and the police. Our guide on how to report snooping at work sets out each route and when it applies.

How do I secure my laptop afterwards?

Change the passwords someone could have seen or used, and make sure nobody is still signed in somewhere they shouldn't be. The NCSC's steps for recovering an account are a good order to follow.

  1. Change your Mac login password: choose Apple menu > System Settings, click Users & Groups, click the Info button next to your name, then click Change. On a work Mac, check with IT first.
  2. Change the password for any account that may have been opened, and for any other account that uses the same password. The NCSC gives both steps because criminals try a known password across other accounts.
  3. Log all devices and apps out of those accounts. The NCSC says that once you've done this, anyone else trying to use the account will be asked for the new password.
  4. Check your email filters and forwarding rules. The NCSC says criminals set up forwarding rules to receive copies of your emails.
  5. Turn on 2-step verification for important accounts such as email.

On a work laptop, leave the device's own settings to IT. The NCSC tells staff that settings configured by their system administrator help keep information secure, and that changing or getting round them could put information at risk.

How do I stop it happening again?

Lock the screen every time you stand up: Control-Command-Q on a Mac, Windows logo key + L on Windows. It's the single habit that means anyone who sits down needs your password. Automatic locking and hot corners are in how to lock your Mac screen, and desk habits in leaving your laptop at work or in a library.

Is it against the law?

Whether a particular case is an offence depends on the facts, which is why reporting it and letting others look properly is the right step. We set out the law as written in is it illegal to access someone's computer in the UK, and the US position in unauthorised computer access law in the US. For how often this happens, see colleague snooping statistics.

Where Failshot fits

Your password is the first layer. Failshot is the second: a photo of whoever unlocks your Mac while you're away from your desk.

While it's on, Failshot photographs whoever unlocks your Mac, then, with Pro, records a 5-second video, and its window tells them the unlock was photographed. With Pro, turn on alerts and Failshot emails you about an unlock you don't confirm as yours, with the photo and the time. Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

It's for a Mac you own or are authorised to manage, running macOS 14 or later. Free to download. It's free to use. Pro adds video, email alerts and the encrypted vault, and you can try Pro free for 7 days. The trial is on failshot.app, for the Mac. iPhone, Android and Windows are coming soon.

More questions

Should I confront the person?

It's usually better to report it than to confront anyone. Write down what you noticed and give it to IT or HR, who can look at records you can't see. A calm, factual report also keeps the focus on what happened rather than on an argument.

Will the sign-in log show who used my laptop?

Not if it was already unlocked. Anyone using an unlocked laptop is working as you, so there's no new sign-in to record. Sign-in records help when someone signed in themselves. Recent files and browser history can say more about what was opened.

Can IT find out what happened?

Often they can see more than you. Microsoft says an organisation can query event log entries and file names on a corporate-owned Windows device it manages with Intune. What's available depends on how your workplace manages its devices, so ask IT what they can check.

Can I install Failshot on my work Mac?

Only with your employer's agreement. It's their device, and they're responsible under data protection law for any monitoring on it. For Failshot, that also means they've agreed Failshot's Organisation Terms and told everyone who uses the laptop before Failshot is turned on.

Sources