GCHQ lost thousands of USB drives: could you find yours?

If one of the world's most security-conscious organisations cannot say where thousands of its USB sticks have gone, it is fair to ask how confident your own organisation is. On 30 October 2026, the UK's Investigatory Powers Commissioner's Office (IPCO) published its annual report for 2025. It found that GCHQ, the UK's signals intelligence agency, still cannot account for removable storage devices that GCHQ itself estimates to be "in the thousands".

What happened

The missing items include USB sticks, external hard drives, compact discs, memory cards and other portable storage. Some may hold data obtained under the Investigatory Powers Act, although the report does not allege that any device has reached an adversary. IPCO said it was "very concerned" and "disappointed with the time it has taken GCHQ to investigate", noting that the agency had not yet established "a sufficiently clear understanding of the scale, location and recoverability" of the devices.

This was not a new finding. IPCO had asked GCHQ and MI5 in 2023 to review how they allocate and audit removable media. Many of the missing devices were encrypted or PIN-protected, which reduces the risk but does not answer the basic question of where they are. GCHQ has said its "management system for removable media was previously not sufficiently robust" and that it is introducing an automated asset-tracking system.

Why it matters for organisations in Malaysia and ASEAN

The lesson here is less about espionage and more about record keeping. Most organisations have some version of this problem: drives handed out for projects and never returned, personal USB sticks plugged into work laptops, and no single record showing which device touched which machine, or when.

In Malaysia, this now carries clearer legal weight. Under the Personal Data Protection (Amendment) Act 2024, the security principle was extended to data processors from 1 April 2025, and penalties for breaching the data protection principles rose to a fine of up to RM1,000,000, imprisonment of up to three years, or both. Mandatory breach notification and the appointment of a data protection officer took effect on 1 June 2025. A lost drive holding personal data may trigger a notification assessment, and "we are not sure what was on it" is a difficult position to explain to the Commissioner.

Five practical takeaways

1. Decide whether you need removable media at all. Many teams do not. Block USB mass storage by default and approve exceptions with a business reason.
2. Allow only approved devices. Keep a list of company-issued drives so that a personal stick cannot be used to move data off an endpoint.
3. Keep a central log of device activity. Record which device was connected to which endpoint, by which user and when, in one place rather than scattered across individual laptops.
4. Encrypt, but do not stop there. Encryption helped limit GCHQ's exposure, but it is not an inventory. Treat it as one control among several.
5. Rehearse the missing-device scenario. Your DPO should know what evidence to pull, and how quickly, to judge whether a lost drive is a notifiable breach under the PDPA.

How a self-hosted platform helps

nPro DLP includes USB and device control that can block unauthorised removable storage, alongside clipboard protection, screen capture control and cloud upload prevention. Every DLP event is written to the same database and dashboard as nPro's SIEM and XDR data, so an investigator can review device activity alongside endpoint and log events in one place. Because nPro is self-hosted, on-premises or in a private or public cloud you control, those records stay on your infrastructure.

Want to know how much data could be leaving through USB ports and browsers today? Request a free 30-day Data Exposure Audit and see what your endpoints are actually doing before a lost drive forces the question.

Frequently asked questions

What did the IPCO report say about GCHQ's removable media?

IPCO's annual report for 2025, published on 30 October 2026, said GCHQ cannot account for removable storage devices it estimates to number "in the thousands", including USB sticks, external hard drives and memory cards. IPCO said it was "very concerned" about the time taken to investigate. The report does not allege that any device reached an adversary.

Do Malaysian organisations have to report a lost USB drive containing personal data?

Since 1 June 2025, data controllers in Malaysia must notify the Personal Data Protection Commissioner of personal data breaches under the Personal Data Protection (Amendment) Act 2024. Whether a specific lost device must be reported depends on the circumstances, so organisations should assess each case with their data protection officer.

How can organisations prevent data leaks through USB drives?

Block USB mass storage by default, allow only approved company-issued devices, keep a central log of device connections, encrypt approved drives and have a documented procedure for lost devices. Data loss prevention tools with device control can enforce the blocking and logging centrally.

Sources

• The Record: GCHQ cannot account for thousands of data devices, 30 October 2026
• TechRadar: GCHQ has apparently lost thousands of storage devices in recent years, 2 November 2026
• eSecurity Planet: UK spy agency cannot account for thousands of devices that may hold top secrets, 3 November 2026
• Data Protection Report: New horizons in data protection, Malaysia's Personal Data Protection (Amendment) Act 2024, January 2025