If a hard token is lost or damaged, it must be replaced. The user should immediately report the loss to their service provider to prevent unauthorized access.