**Kyushu Electric Power Co., Inc.**, a major regional electric utility in Japan, is grappling with a serious data security incident. The company announced that an external storage device, holding sensitive information for a vast number of its customers, has gone missing from a supposedly secure server room. ### The Incident Unfolds According to **Kyushu Electric**, their IT staff regularly performs backups to manage server storage. On April 27, due to capacity constraints, an external storage device was utilized for this task. The drive was subsequently placed in a server room cabinet, protected by multiple physical security layers. However, on May 26, when IT personnel attempted to retrieve the drive, they discovered the cabinet unlocked and the device missing. The company's investigation has yet to locate the drive or definitively determine its fate. ### Scope of Impacted Data **Kyushu Electric Power Company** supplies electricity across the Kyushu region, which includes prefectures such as Fukuoka, Saga, Nagasaki, Kumamoto, Oita, Miyazaki, and Kagoshima. With a regional population of 12.6 million, the incident potentially impacts up to 10.9 million customer accounts. The data stored on the missing drive includes: * Customer names * Service location addresses * Electricity usage data * Telephone numbers * Names of retail electricity providers * Other related information The company has clarified that no bank account information or credit card data was stored on the lost drive. **Kyushu Electric** has committed to individually notifying all impacted customers in the near future. ### Ongoing Investigation and Regulatory Response Since the discovery of the missing drive, **Kyushu Electric** has conducted internal interviews with all personnel who accessed the server room. Despite these efforts, the drive remains unlocated. Media outlets report that 57 individuals had access to the server room in question, and **Kyushu Electric** filed a police report on June 4, suggesting a suspicion of unauthorized removal. Japan's **Ministry of Economy, Trade and Industry** has reportedly given the firm until July 8 to provide a detailed report on the incident and outline preventative measures taken. The company's bulletin states, “The company is investigating all possibilities, including unauthorized removal of the device, but it has not yet been located.” The incident has also been reported to Japan’s **Personal Information Protection Commission** and other relevant government authorities, highlighting the seriousness of the breach and the regulatory scrutiny it faces.