Japanese energy firm leaks 11M client records

Jun 12
2 min read

Kyushu Electric Power Co. had a big problem last month that I think we can all learn from.

Kyushu Electric is one of Japan's major regional electric utility companies. In an official announcement this week, the company explained how their IT team regularly performs server backups to external storage drives. Back in April, they took a backup of their customer's data, including names, addresses, phone numbers electrical usage and more, stored it on an external drive and put it into a locked cabinet.

On May 26, when IT staff went to retrieve it, they found the cabinet had been left unlocked and the drive was missing. The problem was that it contained information for almost all of their 11 million customers.

The Takeaway

We talk about this regularly during compliance audits. I know that storing backups onto physical media is old school and unsexy, but some of the companies we work with simply have too much data or data growth to store all of it in the cloud. So if you absolutely need to save company data to a portable drive, I recommend you do all of the following:

Password protect the backup. Apply a complex, unique password to the backup images. This may require an extra step in your backup process but it does add a basic layer of defense if one of your drives grows legs.
Enable drive encryption. Encrypting the drive itself ensures that even if your backup images themselves are not encrypted, they are encrypted at rest.
Take backups off-site. Always keep at least one complete copy of your company's data off-site. This way if there's a natural disaster, theft or even something simple like water damage, you're safe.
Test recovery. We've been through several ransomware incidents where the bad actors disabled server backups and maliciously encrypted the backups drives each time they were plugged in. We've also had instances where a client "thought" that backups were being made but it was nothing but empty data. In fact, we almost didn't have a Toy Story movie because of this exact scenario - check out this video on how it happened: How Toy Story 2 Almost Got Deleted. Either way, check the restoration of those off-site backups at least once per month.

If you store patient or government data on those drives, you'll also be subject to additional controls to keep that data protected or you'll face fines or reputation damage, just like Kyushu Electric.

It's my guess that the power company didn't employ any of these safeguards, which would have made the missing backup drive useless in the hands of the thief. For now, Kyushu Electric is still investigating and hoping for the best, but it would have been so much easier for them to have been prepared!

Stay safe out there.

-Attila

New Friday Funnies!

If you put a humidifier and a dehumidifier in the same room, which would win?

The power company.

What do you call a joke about power outages?

Dark humor.

Why are symphony musicians so good with electricity?

They are always near conductors.

What do arsonists and electricity have in common?

They both light up buildings.

How do narcissists save money on their electricity bill?