Japanese electric company loses SSD device containing over 10.9m customer data records

Japanese energy giant Kyushu Electric Power has apologised to customers after it misplaced an external storage drive that contained as many as 10.9 million customer data records.

 

Headquartered in the Fukuoka prefecture in Japan, Kyushu Electric Power supplies electricity to Fukuoka, Nagasaki, Ōita, Saga, Miyazaki, Kumamoto, and Kagoshima prefectures and some parts of Hiroshima prefecture. Founded in 1951, the electric company has an installed power generation capacity of over 15 gigawatts and serves over 13 million customers.

 

The company announced in a press release last week that it recently misplaced an external storage device which had been used to store backups of customer data as a temporary measure. The backup SSD was used as the company ran out of storage space in its internal servers.

 

Kyushu Electric Power said the storage device was loaded with backups of customer data records and stored in an unlocked cabinet in its secure server room on April 27, but discovered on May 26 that the storage device could not be located.

 

"We have conducted interviews with relevant personnel who entered or exited the room between April 27 and May 26, as well as on-site investigations, but the medium has not yet been found," the company said, adding that the server room is access-restricted and only authorised personnel are allowed to enter and exit the location.

 

According to the company, the external storage device contained the names, residential addresses, telephone numbers, electricity usage data and names of retail electricity providers totalling up to 10.9 million data records. Kyushu said the customer data records did not contain bank account or credit card information.

 

The company is investigating the possibility of unauthorised removal of the device but has not been able to identify those involved.

 

"We have already reported the incident to the Personal Information Protection Commission and the relevant regulatory authorities," the electric power company said. "We will continue efforts to locate the external storage medium and will notify the affected customers individually. We will also consider and implement measures to prevent a recurrence regarding the management of external storage media."

 

According to The Asahi Shimbun, as many as 57 employees from 10 contractor companies accessed Kyushu Electric Power’s server room between April 27 and May 26 - the period when the palm-sized SSD went missing. Access to the server room requires and ID card and biometric authentication, but the company did not state if the room was covered with CCTV surveillance cameras.