Did she have Bitlocker or FileVault or other disk encryption that was breeched? (Or they took the system booted as TLAs seek to do?)

There was a story here the other day, bitlocker keys stored in your Microsoft account will be handed over.

breached