2026 Kyushu Electric Power — lost unencrypted backup SSD; up to 10.9M customer accounts
Data compromised
Customer names, service-location addresses, electricity usage data, telephone numbers, retail electricity provider names (contracts Jul 2016–Jan 2024); no bank or card data per company
Technical writeup
Kyushu Electric Power Transmission and Distribution Co., a Kyushu Electric Power subsidiary, announced on June 8, 2026 that an external solid-state backup drive containing customer information could not be located. The device was written on April 27, 2026 during routine server backup work, stored in a server-room cabinet, and discovered missing on May 26 when staff returned for another task. Kyushu Electric stated the incident may affect up to 10.9 million customer accounts in the Kyushu region (excluding remote islands) for contracts between July 2016 and January 2024. Data categories include customer names, service addresses, electricity usage figures, phone numbers, and names of retail electricity providers; the company said bank account and credit card information were not on the drive. Reporting noted the SSD was not password-protected and the cabinet was unlocked, with 57 personnel from ten contractor firms able to access the server room during the interval; a police report was filed June 4, 2026. Individual customer notifications were promised.
Root cause
Physical loss of unencrypted, non-password-protected external backup SSD from unlocked server-room cabinet (discovered May 26, 2026)
References
- https://www.kyuden.co.jp/td/press/2026/260608.html
- https://www.asahi.com/ajw/articles/16629979
- https://www.bleepingcomputer.com/news/security/japanese-energy-firm-loses-drive-with-data-of-109-million-clients/
- https://databreaches.net/2026/06/10/power-company-in-japan-fears-data-breach-after-losing-storage-drive-containing-customer-details/