YOKOHAMA – In a major privacy breach, 18 hard drives used by the Kanagawa Prefectural Government to store taxpayers’ data were auctioned online over the summer instead of being destroyed, prefectural officials disclosed Friday.
The hard drives were sold by an employee of a Tokyo-based recycling company that had been commissioned to scrap them. Nine have been retrieved by the prefecture but the rest remain unaccounted for.
The situation came to light after a man contacted the prefectural government after buying nine of them. Kanagawa officials are asking that anyone who may unwittingly come into possession of the data refrain from disclosing it.
The recycler has been consulting with the police and might file a criminal complaint against the employee, according to the prefecture. According to the contract, the devices should have been destroyed, but the employee sold them to get extra cash.
The data on the retrieved devices totaled 27 terabytes and included individuals’ names, addresses, tax payment records for automobiles, tax investigation notifications to companies, and records of prefectural operations.
The hard drives were used in the Kanagawa Prefectural Government’s data sharing servers but replaced in the spring. Although it had deleted the data, the buyer was able to restore it using special software. The prefecture is trying to locate the other nine drives, which were also sold online from July to August.
The data servers had been leased from Fujitsu Leasing Co., which commissioned Broadlink Co. to scrap the old drives. A male employee has admitted auctioning them off, saying, “I was not aware that they were used at the Kanagawa prefectural office,” according to the prefecture.
A prefectural official said, “It is extremely regrettable. We would like to review our contract with Fujitsu Leasing so that data in hard drives will be deleted through physical destruction.”
Fujitsu Leasing declined to comment.
Defense Minister Taro Kono told a news conference Friday that the ministry signed a contract worth about ¥400,000 with Broadlink in fiscal 2018. The ministry is trying to figure out the details of the contract and whether it was compromised as well.