No idea why the parent got downvoted twice (i upvoted to counter one of them). If (and I sincerely doubt it to be the actual case, but the story suggests it is) the researcher is doing paid research and not backing it up at all, those involved in process design (or the researcher themself if there was adequate and clear process guidelines) should be held responsible for some kind of recklessness bordering on fraud. After all, they cannot prove that they have actually done any research right now and someone could similarly take millions and just "lose a laptop". It is comparable to not keeping proper financial records which is typically criminal.