Japan Data Breach: Kyushu Electric Loses Unencrypted SSD with 10.9 Million Customer Records

Kyushu Electric Power Transmission and Distribution disclosed on June 8 that a backup solid-state drive containing personal records for up to 10.9 million customers is missing and was neither encrypted nor password-protected. The unencrypted SSD was stored in a biometric-protected server room and disappeared sometime between late April and May, with 57 people from 10 contracting firms having accessed the room during that window. Authorities were notified on June 4. The breach is described as the largest in Japan’s history, though there is currently no evidence of data leakage. NIST 800-209 standards require encryption of backup media.