A Japanese electricity company has lost a physical storage drive containing personal data belonging to 10.9 million customers.
The utility confirmed the incident and issued a public apology. Physical media losses are harder to investigate than network breaches: there are no server logs to audit, no IP addresses to trace, and no way to establish definitively whether the data has been read or copied. Unlike a remote intrusion, a missing drive produces almost no forensic trail.
At nearly 11 million records, this is a significant exposure for a utility sector that routinely holds home addresses, billing data, and energy usage patterns. Physical drive security has a well-known, affordable solution - encryption at rest combined with strict chain-of-custody controls for removable media - which makes incidents like this particularly hard to defend. Japan has tightened its personal data rules in recent years, and regulators will likely scrutinize both what information was on the drive and whether its handling met current requirements.
The apology is noted. The harder question is simpler: why was a drive holding records for millions of customers in a position where it could just disappear.