Photo/Illutration Shoichi Sakaki, center, president of Broadlink Co., speaks at a news conference in Tokyo on Dec. 9. (Kazutaka Eguchi)

Broadlink Co. said a former employee arrested over the theft of 12 hard disk drives from the information equipment company stole and sold more than 3,900 data storage devices on the Internet.

Shoichi Sakaki, the president of the Tokyo-based company, apologized for the scandal, which involves leaked data of the Kanagawa prefectural government, at a news conference in the capital on Dec. 9. He said he would resign after he takes measures to prevent a recurrence.

When asked if data remained on the thousands of storage media that had been sold, another company official said: “We cannot say the possibility is zero. We are confirming that now.”

The Asahi Shimbun earlier this month reported that hard disk drives once used by the Kanagawa prefectural government were sold on Internet auction sites. At least 18 hard disks still contained personal information about residents and administrative files.

Yuichi Takahashi, 51, who was supposed to have wiped clean the hard disks at Broadlink, was fired after he admitted to stealing and selling the 18 hard disks.

He was arrested on suspicion over the theft of 12 other hard disks from the company.

Sasaki said Broadlink’s investigation into the matter found that 7,844 items from the company had been posted and bought through Yafuoku (Yahoo! Auction) or flea market app Mercari since Takahashi started working as a full-time employee at the company in February 2016.

Of these items, 3,904 could store data, such as hard disks, flash drives and smartphones.

The company did not rule out the possibility that employees other than Takahashi were involved in the same practice.

“We are considering interviewing all the employees,” the official said.

Takahashi might have come in contact with 228,832 items, including hard disks, over the course of his work at Broadlink.

The company said it will check every single item to determine if there was another data leak by checking the serial numbers of the stolen items with images from the auction sites.

Some people have contacted the company, saying they might have bought the stolen storage units. Broadlink is calling on people to provide information through a hot line it has set up.

The company processes about 700,000 to 1 million items a year under contract with 1,000 to 1,500 companies. About 75 percent of the items are data storage media, including hard disks.

About 70 percent of the storage devices are wiped clean of data and recycled, while the remaining 30 percent are supposed to be destroyed.

The recyclable items are managed through a numbering system. However, the company has no system to check if items slated for destruction are actually destroyed.

“I deeply feel that our security management was lax,” Sakaki said.

The company official said the bags of part-time workers were checked whenever they left their workplace room. They worked on fixed schedules, making such checks easier to manage.

On the other hand, full-time workers, including Takahashi, sometimes had to work overtime hours, so their schedules were not fixed and they could avoid inspections, the company said.

Broadlink’s website had said its clients included financial institutions, courts and the Defense Ministry.

The ministry said it has suspended Broadlink from its list of contractors for nine months from Dec. 9.

According to the ministry, it had 11 contracts with Broadlink from fiscal 2016 to fiscal 2019. Ten contracts, worth a total of 5.75 million yen ($52,933), involved the sales of used personal computers, hard disk drives and LCD monitors.

The ministry said it permanently erased the memory of devices before handing them to Broadlink, so there are no concerns about information leaks.

(This article was written by Chihiro Ara, Kayoko Sekiguchi, and Shingo Tsuru.)