Between all the tackles, concussions, and other injuries a football player typically receives, the medical records for teams and leagues must be extensive, to say the least. Now a thief may have found out just how extensive, following a theft that nabbed the healthcare records for thousands of players from the past 13 years.

The National Football League (NFL) has informed its players of a theft in which someone stole the laptop of a Washington Redskins athletic trainer. In that laptop is the medical exam results for players from 2004-2016, among other records, along with an external hard drive and several paper records. Given that it covers the attendees, and not just the Washington Redskins players alone, that could encompass a huge portion of NFL players.

While the stolen computer is password protected, The Hill reports, there was no encryption on the files, in spite of warnings from the Department of Health and Human Services (HHS) that encryption is a necessary precaution. Should the password be broken (and let’s hope that the trainer used a strong password), thousands of players will have their medical records exposed, and even then, the stolen paper records still put many Redskins players at risk.

Although stolen computers and papers are awful, a stolen device can be protected with the right encryption and strong passwords. According to Susan McAndrew, deputy director of health information privacy at HHS’s Office for Civil Rights:

“Covered entities and business associates must understand that mobile device security is their obligation. Our message to these organizations is simple: encryption is your best defense against these incidents.”

While there are plenty of methods that cyber criminals can use to break into computers from far away, not everything has to be done remotely; old fashioned physical theft can be just as damaging, but when devices are stolen, strong encryption can make a big difference.

Photo by rattler97