The Boise, Idaho-based utility, which supplies electricity to some 460,000 customers in southern Idaho and eastern Oregon, had hired Grant Korth of Nampa, Idaho, to recycle the 230 drives, the company said.

Hart said that Idaho Power should have required its outsourcing firm certify that the drives had been cleaned. He also noted that the issue extends beyond Idaho Power -- even to his own organization.

Hart noted that he bought 25 used computers from the University of Cincinnati a year ago to test its drives for a presentation to be made by his consulting firm, Cincinnati-based Cybercon.

Hart found that the computers unscrubbed drives held university public safety and criminal records data. The university is now putting policies putting in place policies to prevent similar problems, Hart said.

"Even working at the university, it took a while to bring it to their attention," he said.