Kyushu Electric Power Data Breach Exposes 10.9 Million Customer Records in Japan’s Largest-Ever Breach Kyushu Electric Power Transmission and Distribution Co., a subsidiary of one of Japan’s largest regional utilities, disclosed on June 8, 2026, that a palm-sized solid-state drive (SSD) containing personal data for up to 10.9 million customers had gone missing. The unencrypted and unprotected device stored in a biometrically secured server room contained sensitive information, including customer names, service addresses, telephone numbers, electricity usage data, and retail supplier details. The incident marks the largest personal data breach in Japanese history, surpassing the 7.93 million-record breach at travel company JTB in 2016. The breach stemmed from a routine backup procedure on April 27, 2026, when a contractor copied the customer database onto the SSD due to insufficient server storage. The drive was placed in an unlocked cabinet within a server room protected by biometric access controls. When the contractor returned on May 26, the SSD was gone. Security logs revealed that 57 individuals from 10 different contracting firms had accessed the room during the 30-day window between storage and discovery. Despite a police report filed on June 4, the drive remains unrecovered, and the company has found no evidence of data leakage. The most critical failure was the lack of encryption. Under NIST’s Special Publication 800-209, portable backup media must be encrypted to prevent unauthorized access in cases of physical loss or theft. Kyushu Electric’s oversight left the data fully exposed, turning a missing device into a major breach. The incident also highlights a broader pattern: KPMG Japan reports that subcontractors and business partners account for 10.8% of security incidents in Japanese organizations, a trend this breach exemplifies. Unlike previous large-scale breaches in Japan such as those at JTB (2016) and Kaikatsu Club (2025) this incident involves a critical infrastructure operator. Kyushu Electric serves seven prefectures, including Fukuoka, Nagasaki, and Kumamoto, with a customer base representing 12.6 million people. While the exposed data did not include financial information, the combination of names, addresses, and electricity usage patterns creates significant risks, including targeted phishing, identity fraud, and physical security threats. Japan’s Act on the Protection of Personal Information (APPI) requires breach notifications to regulators and affected individuals without delay. Kyushu Electric has notified the Personal Information Protection Commission and the Ministry of Economy, Trade and Industry (METI), with a full incident report due by July 8, 2026. Individual customer notifications are pending. Current penalties under APPI cap at ¥100 million ($700,000), but a 2026 amendment bill expected to pass would introduce administrative fines based on economic benefit from violations, potentially increasing financial consequences for future breaches. The incident underscores a gap in critical infrastructure security: while cybersecurity frameworks emphasize network defenses, physical security of data storage media remains underregulated. The breach occurred despite biometric access controls, as downstream failures an unlocked cabinet and unencrypted data left the information vulnerable. The case serves as a reminder that physical security risks can be as severe as cyber threats, particularly when basic safeguards are overlooked.