For: users of the Kyushu Electric Power Transmission and Distribution "Electricity Usage and Charge Inquiry" service (customers on remote islands, and registered members on mainland Kyushu who sell electricity to the company). The notice does not say which customers the 4,139 leaked records cover. This article is an explanation based on the company's official notice; it does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
users of the Kyushu Electric Power Transmission and Distribution "Electricity Usage and Charge Inquiry" service (customers on remote islands, and registered members on mainland Kyushu who sell electricity to the company). The notice does not say which customers the 4,139 leaked records cover.
- Confirmed so farSee the table ↓
- Detection and system stop
- Report to authorities
- Electricity Usage and Charge Inquiry service
1 more
- Stable supply of electricity
Listed as possibly affected
- Unauthorized access and leak
- Leak of electricity data
- Count
4 more
- Electricity usage (monthly and 30-minute values)
- Demand-side supply point identification number
- Electricity sold (monthly and 30-minute values)
- Generation-side receiving point identification number
- Not yet confirmed
- Cause (how the access happened)
- Which customers are affected
- How the individual notice will be sent
2 more
- When the inquiry service will be restored
- Whether the data has been misused
- What to do nowSee the steps ↓
- Wait for the individual notice, and do not respond to fake notices
- Do not respond to switching or sales calls and visits that use a supply point number
- While the inquiry service is down, check in another way
1 more
- Check whether you reused the inquiry service's password elsewhere
- Where to verify (source)All sources ↓
- Kyushu Electric Power Transmission and Distribution, "Possible leak of electricity data due to unauthorized access to our system and suspension of some services" (November 5, 2026, in Japanese)
- Last checked
- As of November 12, 2026
Follow-up plans and what we checked
The company says it will notify affected customers individually around mid-November under the Act on the Protection of Personal Information. When we checked the company's notices on November 12, 2026, we found no follow-up after the November 5 notice.
What customers who may be affected should do today
Wait for the individual notice, and do not respond to fake notices
The company says it will notify affected customers individually (around mid-November). The notice does not say how.
Around an announcement, fake emails and texts that claim "you are affected" or "log in to confirm" in the name of a notice or a power company are more likely to circulate (our view). Do not open links in emails or texts. Check on the company's official site that you open yourself, or through the contact point on your bill or meter-reading slip. How to spot them is in What is phishing?.
Do not respond to switching or sales calls and visits that use a supply point number
The information that may have leaked includes the demand-side supply point identification number and the generation-side receiving point identification number. These identify the place of your contract and are separate from your name or phone number. The notice says nothing about how these numbers might be used.
In general, someone who can state a number that identifies your location sounds like a genuine business. If someone quotes the number and urges "you will pay less if you switch" or "you must act now", do not answer on the spot; check with your power company yourself. Do not give the number to anyone who asks.
While the inquiry service is down, check in another way
The company has stopped the web service where registered members, among customers on remote islands and customers selling electricity to the company on mainland Kyushu, look up usage and contract information. The restoration date is under review.
The notice does not describe an alternative. Check usage and charges on your bill or meter-reading slip, and if you need a procedure, ask through the contact link on the company's site.
Check whether you reused the inquiry service's password elsewhere
The notice does not say that the IDs or passwords of the inquiry service leaked. It says the service is stopped because the system was disconnected from the network.
As a precaution, if you use the same password on other sites, change it on those sites and turn on two-step verification. See How to check for unauthorized access.
What happened (from the company's notice)
The following is what the company announced on November 5, 2026.
October 30 (Fri)
Detected an unnatural error in its system; the investigation showed unauthorized access was possible, and it urgently stopped the system.Afterwards
A server log investigation showed that some of the information it holds may have leaked outside the company (no date given).November 2 (Mon)
Reported to the Personal Information Protection Commission and the supervising authority.November 5
Published the notice. The system is disconnected from the network and some services are stopped. The stable supply of electricity is not affected.Around mid-November
Plans to notify affected customers individually.
- Background
- Detected an unnatural error on October 30, found possible unauthorized access on investigation, and urgently stopped the system. A server log investigation showed possible leakage
- Information that may have leaked
- Electricity usage (monthly values, 30-minute values) with the demand-side supply point identification number. Electricity sold (monthly values, 30-minute values) with the generation-side receiving point identification number
- Count
- 4,139 records
- Not included
- Contract information such as customer names, addresses, phone numbers, email addresses and bank account information
- Response
- Will notify affected customers individually under the Act on the Protection of Personal Information (around mid-November). Reported to the Personal Information Protection Commission and the supervising authority on November 2
- Stopped service
- Electricity Usage and Charge Inquiry service (restoration under review). The stable supply of electricity is not affected
What is known and what is not
Based on the company's notice (November 5) as of November 12, 2026. When there is a follow-up, we will rewrite the status column.
| Item | What the notice says | Status |
|---|---|---|
| Detection and system stop | An unnatural error was detected on October 30; the system was urgently stopped | Confirmed (company) |
| Unauthorized access and leak | Possible | Possible (company) |
| Leak of electricity data | A server log investigation showed it may have leaked outside the company | Possible (company) |
| Count | 4,139 records | Possible (company) |
| Electricity usage (monthly and 30-minute values) | Included in the information that may have leaked | Possible (company) |
| Demand-side supply point identification number | Included in the information that may have leaked | Possible (company) |
| Electricity sold (monthly and 30-minute values) | Included in the information that may have leaked | Possible (company) |
| Generation-side receiving point identification number | Included in the information that may have leaked | Possible (company) |
| Customer name, address, phone number, email address | Not included | Not included (company) |
| Bank account information and other contract information | Not included | Not included (company) |
| IDs and passwords of the inquiry service | Not listed as an item | Not stated |
| Which customers are affected | Says it will notify "affected customers" individually; the range is not stated | Not stated |
| Individual notice | Around mid-November; the method is not stated | Planned (company) |
| Report to authorities | Reported to the Personal Information Protection Commission and the supervising authority on November 2 | Confirmed (company) |
| Electricity Usage and Charge Inquiry service | Stopped; restoration under review | Confirmed (company) |
| Stable supply of electricity | Not affected | Confirmed (company) |
| Cause and route of the intrusion | Not stated | Not stated |
| Harm from misuse | We found no statement that any has been confirmed | Not stated |
The notice does not state the range of affected customers. The stopped inquiry service is used by customers on remote islands and by registered members who sell electricity on mainland Kyushu, but the notice does not show whether the information that may have leaked belongs only to those customers.
What electricity data and numbers can be used for
The table below shows what can happen in general with these kinds of items. It does not mean that any of this happened in this incident.
| Information that may have leaked | What can happen in general | What customers can do |
|---|---|---|
| Supply point and receiving point identification numbers | Switching or sales calls and visits that seem to know your contract location | Do not give the number; check with your provider yourself |
| 30-minute electricity usage | Daily patterns such as when you are home or away can be read | Do not respond on the spot to suspicious visits or sales pitches |
| Electricity sold (monthly and 30-minute values) | Shows whether and how large your generation equipment is; may be used for equipment sales or construction pitches | Check with your provider about visits that urge equipment inspection or construction |
| Fake emails and texts about the notice | Claim "you are affected" and lead to a fake site | Do not open links; check on the official site |
What can happen with information that may have leaked
- Genuine-looking emails, texts and calls in the name of a notice or a power company
- Switching or rate-review pitches that use the supply point number
- Daily patterns guessed from 30-minute usage
Stated as not included in the notice
- Customer names
- Addresses, phone numbers and email addresses
- Contract information such as bank account information
What operators should review: the range of data held by an inquiry system
The cause has not been disclosed, so this section only covers what can be said from the published facts.
- Decide in advance what to do first when you detect an anomaly: The company started an investigation on detecting an unnatural error and, once it found possible unauthorized access, urgently stopped the system. Stopping first and examining logs afterward can narrow the damage. On the other hand, disconnecting the system also takes down the customer-facing inquiry service. Deciding in advance what to tell users when you stop it reduces confusion.
- Separate what an inquiry needs from what you keep: The company says contract information such as names, addresses and bank accounts is not included. But 30-minute usage together with a number that identifies a location can reveal daily patterns and the presence of equipment on its own. In general, fine-grained time records are easy to tie to a person even when separated from contract information, so limiting retention periods and who can view them is effective.
Sources (public record)
The facts in this article are based on the official notice below. We have not speculated about details of the cause that have not been disclosed.
- Kyushu Electric Power Transmission and Distribution, "Possible leak of electricity data due to unauthorized access to our system and suspension of some services" (November 5, 2026, in Japanese) — kyuden.co.jp
Update history
2026-11-12: First version. Based on the company's notice of November 5. We checked the company's notices the same day and found no follow-up.
Read next
- How to spot fake contact: What is phishing? / Smartphone security basics
- Suspicious activity on an account: How to check for unauthorized access
- Another energy company's customer data incident: ENGIE (France) customer data breach
- Other incidents in 2026: Data breaches and cyberattacks (Japan and overseas)