Japanese energy firm loses drive with data of 10.9 million clients
Kyushu Electric says an external drive with customer data for up to 10.9 million accounts went missing from a locked server room cabinet.
Intelligence analysis by GPT-5.4 Mini
Kyushu Electric Power says a backup drive containing customer information vanished after being stored in a server room cabinet. The company says it has no evidence that bank or card data was on the device, but it is investigating the loss and notifying customers.
A power company put customer information on a backup drive, then the drive disappeared from a room it was supposed to be safe in. It is like leaving a school list in a locked drawer and later finding the drawer open and the list gone.
Analysis
What happened
Kyushu Electric Power Co. says it used an external storage device for routine backups on April 27 because its servers were short on capacity. The drive was placed in a server-room cabinet that was supposed to be protected by multiple physical security layers.
On May 26, staff returned to retrieve it and found the cabinet unlocked and the drive missing. The company says it has interviewed everyone with access to the room, but it still has not found the device.
What data may be exposed
The missing drive reportedly contained customer names, service location addresses, electricity usage data, telephone numbers, and the names of retail electricity providers. Kyushu Electric says no bank account information or credit card data was stored on the drive.
The company said the incident may affect up to 10.9 million accounts, which is a large share of the Kyushu region’s population. It also said it will notify affected customers individually.
Response and oversight
According to the report, 57 people had access to the server room, and Kyushu Electric filed a police report on June 4, suspecting the drive may have been removed. The incident was also reported to Japan’s Personal Information Protection Commission and other government authorities.
NHK One reported that Japan’s Ministry of Economy, Trade and Industry gave the company until July 8 to submit a full report on the incident and the steps taken to prevent a repeat.
The case is a reminder that sensitive data can be put at risk by plain physical mishandling, not only by malware or network intrusions. Backup controls, access control, and device tracking matter as much as perimeter security when large customer datasets are involved.
Key points
- Kyushu Electric says an external backup drive went missing from a server-room cabinet.
- The drive may contain data tied to up to 10.9 million customer accounts.
- The data includes names, addresses, phone numbers, electricity usage data, and retail provider names.
- The company says no bank account or credit card data was stored on the device.
- Police and Japanese regulators have been notified, and customers will be informed individually.
The company says no bank or credit card data was on the missing drive, which may reduce the most serious financial fraud risks. If its investigation and notifications are thorough, affected customers and regulators can respond quickly and limit further harm.
If the drive was taken by an unauthorized person, the exposed contact and usage data could still be misused for scams or privacy abuse. The fact that the device has not been found also means the company cannot yet confirm the full scope of the loss or whether the data will remain contained.
