TOKYO — The final thing the technician was supposed to do after a shift last week was clear the USB sticks of their confidential information.
Instead, once he had transferred the data, he dropped the tiny storage devices into his bag and headed to an izakaya. There, he spent about three hours drinking sake with three colleagues, then stumbled into the streets before eventually passing out.
By the time he woke up around 3 a.m. last Wednesday, his bag — containing the two USB drives, one of them a backup device with the same information — was gone. So was his precise memory of what had happened.
Also missing, embarrassed officials in Amagasaki, an industrial city northwest of Osaka, explained at a news conference, were the names, birthdays and ID numbers of about 460,000 people: the entire population of the city.Their home addresses and bank details were in the trove of data, too.
The man, who has not been identified, was a subcontractor of Biprogy, a technology company hired by the city to distribute subsidies to families affected by the coronavirus pandemic. Part of that task involved moving the residents’ private details from the city’s computers to those of a call center in Suita, a nearby city in the Osaka prefecture, that would help them with the details of the payout.
He took the next day off from work to look for the drives. Failing to find them, later that day he reported the loss to the police station in Suita, where he had gone drinking with colleagues. He alerted his workplace.
The following day, company formed a search party. When that effort failed, Amagasaki officials held their contrite briefing.
“I apologize from my heart for giving trouble to the citizens,” Kazumi Inamura, the mayor of Amagasaki, said at the news conference.
The information on the USB sticks was protected by a 13-digit alphanumeric password, added Tomotsugu Nakao, another city official, in an apparent attempt to reassure the public that failed to achieve its goal.
Angry residents flooded the city office with 30,000 angry calls within 24 hours. Online users scoured listings on online marketplaces for “encrypted flash drives in Amagasaki” and speculated how long it would take to crack the password. One electronics company seized the opportunity to remind the public about its encrypted USB sticks, which they described as impervious to data breaches.
The next day, two days after their disappearance, the lost thumb drives resurfaced, still in the same bag, outside an apartment building in Suita. Biprogy held another news conference to share the good news.
It was unclear how the USB sticks had gotten there, or who had found them, but company officials said that the passwords were unchanged, and there were so far no indications that the data had been compromised.
“He was drunk to the extent that he fell asleep. His memory was vague, so it’s possible that he himself went there as well,” said Yuji Takeuchi, a company director, in offering one theory.
Mr. Takeuchi said that the company had not sufficiently explained to city officials that USB drives would be used to transfer the data, and that only one employee would be carrying out the task. In the future, he added, the company would use more than one employee for such data transfers or hire secure delivery services.
“Fiercely reflecting on the case, we will conduct education to our employees so that this won’t happen again,” he said.
A Biprogy representative said that the employee had worked for nearly two decades in the industry and deeply regretted his failure to immediately wipe the data after completing his work. Akiyoshi Hiraoka, Biprogy’s president and chief executive, said that the employee would be disciplined, though the company had not yet decided how.
USB sticks, small and easy to misplace, have played a role in costly mishaps before. Heathrow Airport was fined $147,000 in 2018 after an employee lost an unencrypted hard drive containing, among other things, the names, passport numbers and birthdays of 10 people.
But many items lost in Japan have also been recovered. The country has operated highly effective lost and found networks for years, with approximately 6,000 capsule police stations known as “koban” in neighborhoods across the country.
In 2015, 26.7 million items, excluding cash, were brought to the Japanese police. In 2016, 3.67 billion yen, or about $27 million in cash, was returned to the police in Tokyo alone.
Makiko Inoue reported from Tokyo and Tiffany May from Hong Kong.
