Wiping the Wrong Device

An irreversible action was taken against the wrong device. The handling determines whether this is an unfortunate incident or a lasting story.

The first minutes

Stop any further action immediately: cancel pending commands, halt bulk operations.

Establish what was issued, to which device, and whether it has been received.

For an independent baseline relevant to “Wiping the Wrong Device”, the NCSC mobile-device guidance is a useful companion: compare its principles with the proposed configuration, ownership model and real support process before approving a rollout.

If the command is pending and the device is offline, cancellation may still be possible — this is the only window and it closes when the device next checks in.

Then tell the person, before they discover it.

What can sometimes be recovered

Anything backed up to the platform's own cloud service, which many people have enabled without thinking about it.

Photographs synced to a personal account.

Messages, depending on the service and the backup state.

Help them check rather than leaving them to it, because the first hours matter and most people do not know what they had enabled.

What cannot

Anything local only: notes, downloaded media, application data without cloud sync, recent photographs not yet uploaded.

Be honest about this immediately rather than offering hope that will not survive the afternoon.

The conversation

Direct, without hedging: we issued an action against your device by mistake, here is what it removed, here is what we are doing.

Apologise plainly.

Do not explain the process failure in the first conversation, which reads as deflection; that belongs in the follow-up.

Making it right

Replacement of anything replaceable.

Time to sort it out, during working hours.

And where personal data of real value was lost, acknowledge that money does not fix it — which is uncomfortable and better than pretending otherwise.

The follow-up

Written: what happened, why, what has changed.

Within a few days.

And the change should be structural: ownership model visible at the point of action, selective as default, full wipe requiring a second approval, or the capability removed entirely on personal devices.

"We will be more careful" is not a change.

Telling the organisation

Quietly handling it and hoping nobody hears is the instinct and the wrong one, because people talk.

A short internal note saying it happened, what was lost, and what has changed does more for the programme's standing than silence.

Preventing the repeat

The structural controls in the irreversibility note.

Plus: review the log monthly, so that a near miss is visible before it is a hit.

What to check

Could you cancel a pending wipe command right now if you had to?

Does anybody review the action log?

If this happened tomorrow, who would speak to the person?

And is the prevention structural or procedural?