When Hospital Hard Drives End Up at Auction: The Hokkaido Data Breach

A waste disposal company. A batch of unwiped hard drives. Up to 510,000 patient records were exposed.

In June 2026, Japan’s National Hospital Organization disclosed that hard drives from two hospitals in Hokkaido had been listed and sold on online auction sites. The drives contained personal information belonging to patients and staff at the Hokkaido Medical Center and the Hokkaido Cancer Center, including names, addresses, dates of birth, and medical diagnoses.

The breach came to light after someone who purchased a hard drive at an online auction site contacted the Hokkaido Medical Center to report that the device appeared to contain the hospital’s patient data. The hospital launched an investigation and recovered a total of 33 hard drives that had been used to store digital medical records. Officials confirmed the drives contained personal information on at least 186,900 patients and staff members. The National Hospital Organization warned the total number of individuals potentially affected could reach 510,000.

The two hospitals had contracted the same waste disposal company in the city of Ishikari to destroy the storage devices. The drives are believed to have entered the secondary market after being improperly handled during the decommissioning or disposal process.

What went wrong

The breach did not involve a cyberattack, a phishing campaign, or a software vulnerability. It happened because 33 hard drives that should have been securely destroyed before leaving the hospitals were not.

Whether the drives were passed to a third party without being wiped, whether they were stolen during the disposal process, or whether the waste disposal contractor failed to follow the agreed destruction procedures has not been fully confirmed in reporting at the time of publication. What is confirmed is that the drives reached the secondary market with readable patient data still on them.

How Opal Lock closes this gap

When a TCG Opal self-encrypting drive is retired, cryptographic erase deletes the encryption key. Once the key is gone, the data on the drive is permanently unrecoverable regardless of what happens to the physical device after that. It does not matter whether the drive is sold at auction, passed to a third party, or recovered from a skip. Without the key, the data cannot be read.

Opal Lock by Fidelity Height performs cryptographic erase on compatible TCG Opal and Pyrite drives using the admin password or the PSID printed on the drive label, which means it can be completed even if the admin password is unavailable. After a successful erase, a Certificate of Sanitization is generated automatically. That certificate provides documented, verifiable evidence that the drive was securely wiped before it left the organization, the kind of record an auditor, a regulator, or a hospital administrator can produce to demonstrate that proper decommissioning procedures were followed.

For IT teams and MSPs managing fleets of devices, Opal Lock Premium includes the Multidrive Feature, which allows retirement operations to be run across multiple drives in a single step rather than one device at a time.

The point

The Hokkaido breach did not require a sophisticated attacker. It required a batch of hard drives that left a hospital without being wiped, and an online auction site where someone found them and recognized what was on them.

The data on those drives could have been made permanently unrecoverable before they left the building. The process exists. The tools exist. What was missing was the step that should come before any storage device leaves an organization.

Compare Opal Lock editions at fidelityheight.com/shops/

Sources: Japan Today, Xinhua, The Star, NHK (via DataBreaches.net) June 2026