Kyushu Electric TD 2026 Data Breach

The SSD was confirmed in its cabinet after the April 27 backup and was found missing during preparation for the next job on May 26. Access to the server room was restricted through identity, card, and biometric controls, but the cabinet inside it was not locked. The external medium was neither encrypted nor password-protected. The company filed a police report June 4 and said the investigation remained in progress.

In its July 8 report, the company said its monitoring had found neither an SSD listing on resale platforms nor information published online and that it had identified no data leakage at that time. That statement does not change the fact that the medium is missing, but the missing medium alone also does not prove that its contents were copied or published.

The initial June 8 notice referred to a maximum of 10.9 million service-point records. The July 8 attachment revised the measurement after considering moves, name changes, and matching name-and-address duplicates. Its final table shows 8.99 million individual and 3.17 million organization/other records in the transmission-system category, 530,000 individual and 260,000 organization/other records in the switching-support category, and 510,000 individual and 80,000 organization/other records in the category registered in both systems. The table reports 10.03 million individual, 3.51 million organization/other, and 13.54 million total information records.

The organization/other category includes multiple contracts held by the same entity and about 1.46 million contracts tied to equipment such as streetlights and traffic signals. The total is therefore not labelled as a customer or person count. The live catalogue has no local import job or searchable person-level data associated with this event.

The official report lists customer names, service-location addresses, electricity-usage data, retail electricity-provider names, supply-point identification numbers, and contract or application information. Phone numbers occurred only in selected switching-support records. The SSD did not contain bank-account, credit-card, or email-address information.

The company said it would send direct mail to affected customers beginning in early August and would not ask them to complete a separate procedure. Unexpected electricity-service messages, payment requests, or links that use address, usage, or contract details should be checked through an independent contact channel opened from the current kyuden.co.jp domain. A match alone does not show that a third party read the medium or misused a particular record.