LAC: a former employee sold a hard disk with privately backed-up business data at a flea market, and business documents leaked

1. 2021-10-31

   An anonymous email reported that a hard disk bought at a flea market held its business documents. [1] [2]

2. 2021-11-02

   From screenshots sent by the reporter it confirmed they were its documents and judged that information had leaked. [1] [2]

3. 2021-11-30

   It traced the source to a former employee who had kept business data on a personal hard disk and sold it at a flea market. [1]

4. 2021-12-17

   It collected the hard disk from the reporter. [1]

5. 2022-01-14

   It published the investigation result. [1] [2]

The recoverable business documents numbered 2,069, of which 628 belonged to business partners. Personal data covered up to 1,000 entries: company names, departments, names, email addresses and company phone numbers of its own and its partners' staff. It confirmed that the leaked data did not reach third parties and was destroyed. The cause was that the former employee, against the rules, saved a backup on a personal hard disk when PCs were replaced and erased it incompletely before the sale; data erasure at the end of projects had also not been thorough. [1]