TOKYO – The last thing a technician had to do after a shift last week was erase the USB stick of his confidential information.
Instead, after transferring the data, he put the small storage devices in his pocket and headed to an izakaya. There he spent almost three hours with three colleagues drinking, then stumbling about the streets before eventually passing out.
When he woke up around 3am last Wednesday, his bag – which contained two USB sticks, one a backup device with similar information – was gone. So he had a clear memory of what had happened.
The missing, embarrassed officials said at a press conference in Amagasaki, an industrial city northwest of Osaka, they had the names, birthdays and ID numbers of around 460,000 people: the city’s entire population. Your residential address and bank details were also in the data storage.
The person, who has not been identified, was a subcontractor for Biproji, a tech company hired by the city to distribute subsidies to families affected by the coronavirus pandemic. Part of that task was to transfer residents’ personal information from city computers to a call center in the nearby city of Suita, Osaka Prefecture, which would help them with payment details.
The next day he took a break from work to watch the ride. Unable to locate him, he reported the missing person later that day at Suita Police Station, where he had been drinking with accomplices. He alerted his workplace.
The next day, the company formed a search team. When these efforts failed, Amagasaki officials held their opposite briefing.
Amagasaki Mayor Kazumi Inamura said at a press conference, “I apologize from the bottom of my heart for causing trouble to the citizens.”
The information on the USB sticks is protected by a 13-digit alphanumeric password, added another city official, Tomotsugu Nakao, in an apparent attempt to reassure the public who missed their mark.
Angry residents flooded the city office with 30,000 angry calls in 24 hours. Online users searched and typed offers on online marketplaces for “encrypted flash drives in Amagasaki”. how long does it take to crack the passwordAn electronics company took the opportunity to remind the public of its encrypted USB stick, which it said was resilient to data breaches.
The next day, two days after its disappearance, the lost USB stick turned up in the same bag outside a residential building in Suita. Biproji held another press conference to share the good news.
It was unclear how the USB sticks got there or who found them, but company officials said the passwords were unchanged and there was no indication the data had been compromised.
“He was so drunk he fell asleep. His memory was vague, so it’s possible he was there himself,” said company director Yuji Takeuchi, offering a theory.
Mr. Takeuchi said the company did not sufficiently tell city officials that USB drives would be used to transfer the data and that only one employee would perform the task. In the future, the company will employ more than one employee or hire secure delivery services for such data transmissions.
“By looking closely at the matter, we will train our staff so that this does not happen again,” he said.
A Biprogy representative said the employee had worked in the industry for nearly two decades and deeply regretted that he did not promptly delete the data upon termination of his employment. Biproji President and CEO Akiyoshi Hiroka said employees would be disciplined, although the company has not yet decided how.
USB sticks, small and easy to lose, have played a role in costly accidents in the past. Heathrow Airport was fined $147,000 in 2018 after an employee lost an unencrypted hard drive containing 10 people’s names, passport numbers and birthdays, among other things.
But many things lost in Japan were also recovered. The country has operated a highly effective lost-and-found network over the years, with some 6,000 capsule police stations known as “kobans” in neighborhoods across the country.
In 2015, 26.7 million non-cash items were handed over to the Japanese police. In 2016, 3.67 billion yen, or about $27 million in cash, was returned to police in Tokyo alone.
Makiko Inoue reported from Tokyo and Tiffany May from Hong Kong.