Thanks hawtsean and yoyo888.
We actually do have a data protection law here too, and large institutions like where I work have full-time data protections officers, so this breach was reported directly to the data protection commissioners before we were even notified, so the existence of the breach has been officially recorded by the appropriate government body. One problem I won't have is government agencies not believing me it happened. I like the idea of changing my PPS number, but I'm not actually sure that's possible here - will ask though.
We're 90% sure the laptop was stolen by a local teenager who the police have been tracking for quite a while, so the hope is that he's stoo stupid to know what he has, and that he's probably nuked the machines so he can re-sell them. I just hope they don't get sold to anyone more competent before they get wiped :/
B.