Mishandling of hard drive waste triggers data leak from hospitals in Japan

Patient and staff information from two hospitals in Hokkaido, Japan’s northernmost prefecture, has been leaked after a local waste management company mishandled used hard drives, potentially impacting up to 510,000 people, local media reported on Monday.

The issue came to light after a buyer of a hard drive on an online auction site reported to authorities last June that the device contained data belonging to Hokkaido Medical Centre. The hospital subsequently discovered a number of similar hard drives and launched an investigation, according to public broadcaster NHK.

The investigation found that 31 hard drives were formerly used by Hokkaido Medical Centre and two devices had been used by Hokkaido Cancer Centre to store data, including electronic medical records. The devices were confirmed to contain personal information belonging to approximately 187,000 patients and staff, including names, addresses, and medical diagnoses, whilst data pertaining to up to 510,000 people is at risk of being leaked.

Both hospitals had previously commissioned the same waste management company in Ishikari City to destroy the hard drives. However, the company failed to do so, resulting in the hard drives circulating in the second-hand market. The National Hospital Organisation of Japan, which operates both hospitals, has reported the case to the police and filed a criminal complaint against the waste management company.