Report in response to the request for a report concerning the missing external storage device containing customer information at 九州電力送配電株式会社
九州電力送配電株式会社 (a subsidiary of the filing company)
An SSD containing data from the wheeling system and switching support system, which had been stored in a cabinet in the server room
The handling of external storage devices and oversight of the contractor were inadequate. Confirmation of the need for and appropriateness of using external storage devices, their physical storage, protective measures for the data, and instructions and work management for the contractor were inadequate.
Related procedures
Request for a report by the Ministry of Economy, Trade and Industry; police investigation
Ministry of Economy, Trade and Industry; police; Personal Information Protection Commission; Agency for Natural Resources and Energy; Electricity and Gas Market Surveillance Commission
Company response
Interviews with relevant parties by the subsidiary, reviews of entry and exit records, an on-site investigation, and an internal investigation. The police investigation is ongoing. No third-party committee or special investigation committee is mentioned.
Revision of internal rules concerning the handling of information and external storage devices in accordance with the three basic principles governing the use of external storage devices / revision of internal rules concerning the clarification and management of instructions to contractors / information security training for employees and contractors / confirmation of compliance with the revised internal rules and implementation of training / external storage devices will not be used in principle. Where their use is unavoidable, approval must be obtained from an authorized person for the need for and appropriateness of their use and for the device-management measures, including storage methods. / External storage devices will be kept locked in a key-controlled storage location, and the handover of keys will be strictly managed. Where necessary, physical measures such as using highly visible cases or attaching tags will also be implemented. / In principle, password protection or encryption will be applied to prevent third parties from reading information stored on external storage devices. / Matters to be performed by contractors will be specified in specifications and work procedure manuals, and clearly instructed to the contractors. / Information security training will be conducted continuously every year. / Information security managers will conduct self-inspections at all company locations every year.
If it becomes clear that the matter will have a material impact on results, the company will make a timely disclosure.
Individual direct-mail notifications will be sent to affected customers sequentially from early August 2026 onward, as soon as preparations are complete. Customers who cannot be contacted by mail will be notified through the company's website, and a dedicated call center will be established. The police investigation and confirmation of whether any information leakage has occurred will continue.
Individual notifications to affected customers will be sent sequentially from early August 2026 onward. If it becomes clear that the matter will have a material impact on results, the company will make a timely disclosure.
| Item | Details |
|---|---|
| Event name | Report in response to the request for a report concerning the missing external storage device containing customer information at 九州電力送配電株式会社 |
| Date of occurrence | 26 May 2026 (the SSD was found to be missing when preparations were being made for the next work session) |
| Date recognized / date notice received | 8 June 2026 (the request for a report was received from the Ministry of Economy, Trade and Industry) |
| Subject Entity | 九州電力送配電株式会社 (a subsidiary of the filing company) |
| Target Locations / Products | An SSD containing data from the wheeling system and switching support system, which had been stored in a cabinet in the server room |
| Cause | The handling of external storage devices and oversight of the contractor were inadequate. Confirmation of the need for and appropriateness of using external storage devices, their physical storage, protective measures for the data, and instructions and work management for the contractor were inadequate. |
| Impact on Earnings Forecast | If it becomes clear that the matter will have a material impact on results, the company will make a timely disclosure. |
| Type of litigation or proceeding | Request for a report by the Ministry of Economy, Trade and Industry; police investigation |
| Court or authority | Ministry of Economy, Trade and Industry; police; Personal Information Protection Commission; Agency for Natural Resources and Energy; Electricity and Gas Market Surveillance Commission |
| Investigation structure | Interviews with relevant parties by the subsidiary, reviews of entry and exit records, an on-site investigation, and an internal investigation. The police investigation is ongoing. No third-party committee or special investigation committee is mentioned. |
| Measures to prevent recurrence | Revision of internal rules concerning the handling of information and external storage devices in accordance with the three basic principles governing the use of external storage devices / revision of internal rules concerning the clarification and management of instructions to contractors / information security training for employees and contractors / confirmation of compliance with the revised internal rules and implementation of training / external storage devices will not be used in principle. Where their use is unavoidable, approval must be obtained from an authorized person for the need for and appropriateness of their use and for the device-management measures, including storage methods. / External storage devices will be kept locked in a key-controlled storage location, and the handover of keys will be strictly managed. Where necessary, physical measures such as using highly visible cases or attaching tags will also be implemented. / In principle, password protection or encryption will be applied to prevent third parties from reading information stored on external storage devices. / Matters to be performed by contractors will be specified in specifications and work procedure manuals, and clearly instructed to the contractors. / Information security training will be conducted continuously every year. / Information security managers will conduct self-inspections at all company locations every year. |
| Outlook | Individual direct-mail notifications will be sent to affected customers sequentially from early August 2026 onward, as soon as preparations are complete. Customers who cannot be contacted by mail will be notified through the company's website, and a dedicated call center will be established. The police investigation and confirmation of whether any information leakage has occurred will continue. |
| Planned follow-up disclosure | Individual notifications to affected customers will be sent sequentially from early August 2026 onward. If it becomes clear that the matter will have a material impact on results, the company will make a timely disclosure. |
Items this document does not state (12)
These are items the company does not state in this document. We do not leave them blank, nor fill them in from other sources or by inference.
The reasons the company gives
The company's own explanation, not something inferred from the numbers.The handling of external storage devices and oversight of the contractor were inadequate. Specifically, the company explained that confirmation of the need for and appropriateness of using external storage devices, their physical storage, protective measures for the devices themselves, and instructions and work management for the contractor were inadequate.