An encrypted drive was lost in transit: what now?

Is a lost encrypted drive a data breach?#

A lost encrypted drive is a security incident, but whether it is a reportable breach depends mostly on the encryption and the key. Many US state breach notification laws build their definitions around unencrypted personal information, or encrypted information where the key was also acquired. This is often called an encryption safe harbor: if the drive was fully encrypted and the key never left your control, those laws may not require notice to individuals.

That is a starting point, not a conclusion. State definitions differ on what counts as encryption, which data elements are covered and how a compromised key is treated, so counsel should check the states where the affected people live. Sector rules can add their own tests.

Contracts are the second layer. A data license, a data processing agreement or a customer master agreement may require notice of any loss of a device holding covered data, regardless of encryption, and some set short notice clocks. Read the security incident clause before deciding nothing needs to be said.

What to do in the first hours#

The first hours after a missing-shipment alert are for containment and evidence, not conclusions. The aim is to establish what was on the drive, how it was protected and who could plausibly hold it, while the courier's records are still fresh.

• 1Open a formal trace with the courier, not just a damage claim, and ask for every scan event, the last confirmed handler and any exception codes.
• 2Stop all key handoffs. If the passphrase or PIN was due to go to the recipient after delivery, hold it.
• 3Pull the shipment record: drive model and serial number, tamper-evident seal numbers, the file manifest and the hash list produced before packing.
• 4Confirm who had access to the key or recovery code, where it is stored, and whether it was ever sent by email, chat or written on paperwork.
• 5Name one incident owner, usually the IT lead, and open an incident log with a timestamp for every action and decision.
• 6Tell counsel and the data owner the same day so the notice assessment starts early.

How to confirm encryption and key status#

Encryption and key status are the facts that drive every later decision, so prove them with evidence rather than memory. A statement such as 'the drive was encrypted' carries little weight without a configuration record, a verification step and a clear account of where the key lived.

If personal details had already been removed during preparation, record that too. A de-identified dataset on an encrypted drive is a different risk from a raw mailbox export, and the incident file should show which one was lost.

Who needs to know, and in what order#

Notification after a lost drive runs in layers: internal owners first, then contractual parties, then regulators or individuals only if counsel concludes the law requires it. Getting the order wrong causes avoidable problems, such as telling a customer before the facts about the key are confirmed.

Keep every message factual. Say what is known, what is being checked and when the next update will come, and avoid early statements that the data is safe until the key evidence is in the file.

Illustrative: a distributor's archive drive goes missing#

Illustrative: a fictional industrial distributor ships an encrypted drive holding a prepared export of order exceptions, returns and service notes from its NetSuite and help desk systems. The courier's tracking stops at a regional hub, and the recipient reports that nothing arrived.

The IT lead confirms from the preparation log that the full drive was encrypted and test-unlocked before packing. The passphrase sits in the company password manager and was to be shared only after the recipient confirmed the seal numbers, so it never traveled. The manifest shows customer contact details had already been removed during preparation.

Counsel reviews the facts against the laws and contracts that may apply and concludes that a contractual notice to the recipient is required, but individual notice is not. The team retires the old passphrase, re-encrypts a fresh copy under a new key and ships it with signature-required delivery. When the courier later finds the original drive, the distributor has it returned, wipes it and files a destruction record.

Re-shipping without repeating the problem#

A re-shipment should change every element an outsider could exploit, starting with the key. Re-encrypting a fresh copy means the lost drive and the new drive never share a secret, so a later recovery of the first drive changes nothing.

Also ask whether a drive is still the right method. For smaller packages, an encrypted transfer into the recipient's controlled storage may remove the courier risk entirely. For very large datasets, drives remain practical, so tighten the custody steps instead.

• 1Prepare the new copy from the source, not from an image of the lost drive.
• 2Generate a new key or passphrase and record who holds it.
• 3Use new tamper-evident seals and send the seal numbers to the recipient by a separate channel.
• 4Require a signature on delivery and restrict delivery to a named person.
• 5Release the key only after the recipient confirms that the seal and serial numbers match.
• 6Ask the recipient to verify the hash manifest before opening any files.

Mistakes that turn a lost drive into a real incident#

Most serious outcomes from a lost drive trace back to shortcuts taken before shipping, not to the loss itself. The most damaging is a key that traveled with the data: a PIN taped to the drive, a passphrase on the packing slip, or a recovery key emailed to the same address that received the tracking number.

Other mistakes are quieter. An unencrypted staging copy left on a laptop, a manifest that was never saved, or a drive packed by someone who did not record the serial number all make it hard to prove what was lost. A short pre-shipment checklist, signed by the person who packs the drive, prevents most of them.

How SourceX handles drive-based deliveries#

SourceX treats physical drives as a delivery route for large datasets, not as storage. Large datasets stay in the seller's own storage or ship on encrypted drives, and SourceX never hosts multi-TB datasets. Delivery is the last step of the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery.

Before anything ships, the supplier approves the release, and the SourceX Evidence Packet records provenance, licensing rights, permitted use, the privacy record and release authorization. Those are the same facts an incident review needs, so a lost shipment starts from a documented baseline rather than a reconstruction.