Kyushu Electric Power Co. lost a backup drive containing personal data for up to 10.9 million customer accounts. On April 27, IT staff moved server backups onto an external storage device because internal capacity was maxed out. They stashed the drive in a locked cabinet inside a multi‐layered server room—but when they returned on May 26, the cabinet was unlocked and the device was gone. The missing drive held names, service addresses, electricity usage records, phone numbers and details on customers’ retail electricity providers. It did not include bank account or credit card information. Kyushu Electric interviewed everyone who had entered the server room—57 people in total—filed a police report on June 4, and alerted Japan’s Personal Information Protection Commission and other regulators. Japan’s Ministry of Economy, Trade and Industry has instructed the company to submit a full incident report, including countermeasures, by July 8. Kyushu Electric says it will notify affected customers directly as soon as possible. Investigators are still exploring whether someone removed the device deliberately or if there was another breach in physical security.