City in Hyogo Prefecture loses memory drive with info on all 460,000 residents

How and why are governments handing over our personal data to shady corporations!?!?!?

"contractor, whose name has not been disclosed...."

Secret corporations, at that!

I once got a letter from a private company I had never heard of demanding that I tell them my My Number number. The firm said it had been contracted by one of my employers to manage my personal data. I told them to stuff it!

A guy I know lost a company laptop on a train. He got demoted and had to sell his house and moved his family to an apartment. Last time I spoke to him his wife had banned him from drinking for the rest his life. I met outside the station combini, he was drinking a beer.

But there may be a silver lining, as the city says the data was encrypted and the USB locked with a password. So far, officials said, there was no sign the information had been accessed.

All public servants in Japan are required by law to do this to all electronic devices where sensitive information is stored, so at least the person that handled the USB to the contractor did things correctly.

Very soon this incident will be included in the yearly training of cyber-security the officials also have to take.

According to earlier reports yesterday the USB was lost in Suita City, the man had got very drunk, fell asleep in the street and did not wake until sometime between 2-3am on Tuesday morning. Also it was the mayor of Amagasakh that apologized yesterday.

And there was no back up?

Unbelievable!

On a USB stick?

All the data?

On ONE USB stick?

Apart from the personal data aspect, how much is it going to cost us taxpayers to re-enter all this data onto a new USB stick?

Er.. Cloud storage? Data encryption?

These are things that exist...

And there was no back up? Unbelievable!

*"The information was copied onto the USB to facilitate its transfer to a call center in nearby Osaka."*

@BertieWooster

And there was no back up?

The data was copied not moved, so the data is on the PC!

The information was copied onto the USB

whooooooopsie

Japan Inc at its best...anyway still progress if compares to piles papers from fax and handwritten notes in some old suitcase...

So the individual responsible really was drunk and really does remember nothing!

If it was properly encrypted, it shouldn't be a problem. Next time just e-mail the encrypted file. Bog standard e-mail is not secure, but there are secure options and unless you are a target of the NSA, encrypting the file should be enough.

It's Japan. It's probably been handed in at a koban.

If Japan wants some payback for the historic loss of IP, leave some large files of gibberish on an unsecured JR server in a folder named 'Maglev Schematics Encrypted'. Anyone 'finding' it can spend some time trying to 'decrypt' it.

The data was copied not moved, so the data is on the PC!

... running Windows XP.

This isn't the city's fault. It's the private contractor's fault. Have they been fired? Why haven't they apologized?

The city entrusted them with what should be treated as important information, but they allowed an employee to take it home. That is not data security, or at least a level of data security that needs to be outsourced. I'm sure the city would have been capable of this level of incompetence on its own.

Well, at least it wasn't on floppy or CDROM.

How and why are governments handing over our personal data to shady corporations!?!?!?

I don't even like the government having my bank info in the first place with all of the incompetence going on.

Most companies I have worked with, have a minimum 7-day backup, e.g. record back up of day's work each day for 7 days . . . . subsequent week overwrites previous week . . . .

This is why I hate giving over any personal information in Japan. You know it’s likely going to end up on a floppy disk unencrypted in someone’s briefcase.

Isn't outsourcing part of the problem?

running Windows XP.

Probably 98

Er.. Cloud storage? Data encryption?

These are things that exist...

And by law not all can be used precisely because they are not perfect and can be accessed improperly, which leads to these kind of situation.

I've been working in the internal audit / internal control and risk management-field in Japan for the last 18 years. In 2022, I still have to tell people to not share their passwords or tell their password to people calling them on the phone. Also haven't seen much encryption in this country. (full disclosure: I haven't worked on the public side, only corporate-side.)

Public service is a huge mess of paperwork and infinite redundant processes, depending on the place for the information to leave as in that USB several forms have to be filled first asking for permission, then informing the intention to do it and finally to report it was done, checklists with the sofware used for encription and the password used, etc are also common. The contractor should also be qualified by whatever biosecurity committee to handle the information, but obviously this was not enough. For example it is explicitly prohibited for the USB to be separated from the person carrying (putting the bag on the space above the seats in the train is not even allowed). The password is also supposed to be send by e-mail separately, so unless the info is leaked on purpose it can be considered relatively safe.

There are probably many leaks already happening, but this case is not a likely source.

I remember a previous incident involving a floppy and I commented that maybe it's lucky it's only a floppy.

Now we see what happens when it is a USB...

I'm more focused on the fact that the data was stored on a thumb drive instead of a CD-rom or floppy disk. Progress!

On a more serious note, the citizens should take action again the city for gross mishandling and carelessness. What was the contractor even doing having the thumb drive on him while he was out drinking the night away?

was carrying the memory stick during drinks after work.

The individual was probably pressured to go out for drinks with the boss.

It's Japan. It's probably been handed in at a koban.

There is a good chance its been returned to a koban, but unless someone specifically calls the koban and identifies the color, shape, make, style, of the bag containing the USB, they won't get it back. From my experience in Japan, they rarely try to find and contact the person who lost an item. Instead, you have to call around to a hundred different places first.

I was shocked when I saw this news on TV. How irresponsible!

*The city of Amagasaki in Hyogo Prefecture said Thursday that a private contractor, whose name has not been disclosed, was carrying the memory stick during drinks after work.*

Amagasaki anyone who knows this city and what kind of groups lurks in this city(yakuza) knows this is a wonderful place to loose a USB!

Private Contractor, really, wondering if this was really lost.

*It included the names, genders, addresses, birthdays and other personal information of all the city's residents, as well as tax data and bank account information on some locals, the city said.*

This would be a great opportunity for Yakuza

The information was copied onto the USB to facilitate its transfer to a call center in nearby Osaka.

Welcome to Japan. A country that has only recently made the technological jump from floppy disk to USB drive.

If only there was some way of retaining the data, and granting secure access . . . .

Or

Transferring the data decurely without the use of a physical device which could get lost . . . . . .

This is exactly why I am VERY concerned about My Number system!!! They say it is encrypted with a password, I hope it isn't something like 1234 or abcd or 0000, which are very popular!!!!

And there was no back up?

You seem to be missing the point. The whole city's personal info is likely in someone else's hands, and now they will definitely crack the pw and decrypt the information since they know what is on it. Already fake versions of the drive are being sold online.

They say it is encrypted with a password, I hope it isn't something like 1234 or abcd or 0000, which are very popular!!!!

Doesn't matter. A simple tool will crack the pw with ease. Encryption probably won't be a problem either.

I'm rather surprised he didn't lose the papers with the data that were ready to be faxed. The fact that he lost the USB flash is absolutely astonishing and shocking to me, because I could not imagine such a level of technical maturity here... OK, sarcasm..

I bet the USB drive was not encrypted and the data were not in some extra container ala Veracrypt.

Unless they're just trying to hide that it wasn't secured in any way at all, then it's more likely to be a password protected Excel file. Which will be more likely if it really was passed between multiple places as mentioned. Because here as we know, no one is using any standard for communicating across the government so everyone has their own system (even most 区役所 in one city are using different systems) and in order to transfer it somewhere else and open it there, it has to be open in something that absolutely everyone has. And here it is - yes, the popular Excel.

Now they've apologized and no one is going to ask what's next, how this leak is going to be dealt with. If this happened somewhere in Europe or in countries where they have GDPR and generally high data protection at the state level, heads would already roll. And an apology would be the first and last thing anyone would do.

But yeah, 申し訳ございません、しょうがない、大変ですね。

The BBC article on this said the guy passed out drunk in the street and that's when he lost it, along with his bag.