missing backup – Kyushu Electric Power Co., Inc. says a physical security failure led to a missing external storage device containing data tied to up to 10.9 million customers, prompting police involvement and a deadline from Japan’s economy ministry.
A hard drive designed for backups went missing from a server room—then, when staff tried to retrieve it, the cabinet was found unlocked and the device simply wasn’t there.
Kyushu Electric Power Co., Inc. disclosed the incident as a physical security breach affecting private data for more than 10 million customers. The company said its IT staff regularly performs backups to manage server storage. Because of capacity constraints, an external storage device was used for the task on April 27.
After the backup was completed, the drive was stored in a server room cabinet protected by multiple physical security layers. On May 26, when IT staff went to retrieve it, they found the cabinet had been left unlocked and the drive missing.
The company serves electricity across Japan’s Kyushu region. including the prefectures of Fukuoka. Saga. Nagasaki. Kumamoto. Oita. Miyazaki. and Kagoshima. Its announcement says the incident impacts up to 10.9 million accounts—reflecting the scale of what’s at stake when something as basic as physical custody fails.
The data on the missing drive includes customer names. service location addresses. electricity usage data. telephone numbers. names of retail electricity providers. and other related information. Kyushu Electric also clarified that no bank account information or credit card data was stored on the drive.
Even as the company works to understand what happened, it has committed to contacting affected customers individually in the upcoming period.
In the days after the drive was lost, Kyushu Electric interviewed all personnel who entered the server room and conducted investigations, but it still couldn’t locate the device.
Media reporting says 57 people had access to the server room, and the company filed a police report on June 4, suspecting someone removed the drive. The incident has also been reported to Japan’s Personal Information Protection Commission and relevant government authorities.
NHK One reported that Japan’s Ministry of Economy, Trade, and Industry has given Kyushu Electric until July 8 to report details about the incident and the preventative measures it has taken.
“The company is investigating all possibilities, including unauthorized removal of the device, but it has not yet been located,” the bulletin states.
Taken together. the timeline is stark: a backup using an external storage device on April 27. a missing drive discovered on May 26. follow-up interviews and investigations that didn’t turn it up. and a police report filed on June 4—while the company continues to account for both the locked-room breach and the personal data that was stored on the device.
Kyushu Electric Power missing hard drive backup storage device data breach Japan personal information protection commission police report cybersecurity
So basically they just left it unlocked? Wild.
I don’t get how a cabinet can be left unlocked for a month. Like… did nobody check? Also 10 million customers is insane.
Wait, they say no credit card info was on it, but names + addresses + phone numbers… that’s still enough to scam people right? Economy ministry deadline sounds like PR. Probably someone just stole the drive and they’re pretending it was security.
This is why paper records should come back lol. They used an external storage device because of ‘capacity constraints’ so then it goes missing and somehow it’s a ‘physical security failure’ not like hacking? I saw ‘Kyushu Electric’ and thought it was a small company but nope 10.9 million. Hope they don’t just contact people and call it done.