Lost objects: USB sticks with data from 460,000 people

TOKYO — The last thing the technician was supposed to do after a shift last week was wipe USB sticks of their sensitive information.

Instead, once she transferred the data, she dropped the tiny storage devices into her bag and headed to an izakaya. There, she spent about three hours drinking sake with three colleagues, then staggered through the streets before passing out.

When she woke up around 3 a.m. last Wednesday, her bag, which contained the two USB drives, one of them a backup device with the same information, was gone. So was his precise recollection of what had happened.

Embarrassed officials also disappeared in Amagasaki, an industrial city northwest of Osaka, explaining at a news conference the names, birthdays and ID numbers of some 460,000 people – the entire population of the city. Their home addresses and bank details were also in the data trove.

The man, who has not been identified, was a subcontractor for Biprogy, a technology company contracted by the city to distribute grants to families affected by the coronavirus pandemic. Part of that task involved moving residents’ private data from city computers to those at a call center in Suita, a nearby city in Osaka prefecture, that would help them with payment details.

He took the next day off work to look for the units. Unable to find them, later that day he reported the loss to the Suita police station, where he had gone drinking with his colleagues. He alerted the workplace of him.

The next day, the company formed a search party. When that effort failed, Amagasaki officials made their apologetic report.

“I sincerely apologize for causing trouble to citizens,” Kazumi Inamura, mayor of Amagasaki, said at the news conference.

Information on the flash drives was protected by a 13-digit alphanumeric password, added Tomotsugu Nakao, another city official, in an apparent attempt to reassure the public that he had missed the mark.

Angry residents flooded the city office with 30,000 angry calls in 24 hours. Online users searched online marketplace listings for “Amagasaki encrypted flash drives” and speculated how long it would take to crack the password. An electronics company took the opportunity to remind the public about its encrypted USB sticks, which they described as invulnerable to data breaches.

The next day, two days after they disappeared, the missing USB sticks reappeared, still in the same bag, outside an apartment building in Suita. Biprogy held another press conference to share the good news.

It was not clear how the flash drives got there or who found them, but company officials said the passwords did not change and there was no indication so far that the data had been compromised.

“He was so drunk that he fell asleep. Memory of him was vague, so it is possible that he himself went there as well,” said Yuji Takeuchi, director of the company, offering a theory.

Mr. Takeuchi said the company had not sufficiently explained to city officials that USB drives would be used to transfer the data and that only one employee would perform the task. In the future, he added, the company would either use more than one employee for such data transfers or hire secure delivery services.

“Thinking fiercely about the case, we will educate our employees so that this does not happen again,” he said.

A Biprogy representative said that the employee had worked for almost two decades in the industry and deeply regretted not immediately erasing the data after completing his job. Akiyoshi Hiraoka, president and CEO of Biprogy, said the employee would be disciplined, although the company had not yet decided how.

Small and easy to lose, USB flash drives have played a role in costly mishaps in the past. Heathrow Airport was fined $147,000 in 2018 after an employee lost an unencrypted hard drive containing, among other things, the names, passport numbers and birthdays of 10 people.

But many lost items in Japan have also been recovered. The country has operated highly effective lost and found networks for years, with some 6,000 capsule police stations known as “koban” in neighborhoods across the country.

In 2015, 26.7 million items were turned over to the Japanese police, not including cash. In 2016, 3.67 billion yen, or about $27 million in cash, were returned to police in Tokyo alone.

Makiko Inoue reported from Tokyo and Tiffany May from Hong Kong.

Leave a Comment

Your email address will not be published.