Encrypted?
"Amagasaki officials said the data on the USB stick was encrypted"
Yes, but ROT13 is technically encryption...
A Japanese contractor working in the city of Amagasaki, near Osaka, reportedly mislaid a USB drive containing personal data on the metropolis's 460,000 residents. The lock, 17 m wide, having 4 sector gates was designed to protect Amagasaki area with the same elevation of sea level Amagasaki lock in Amagasaki's Nishinomiya …
"SmartTub, like other IoT products, lets users control their appliance from outside the home using an app."
Why oh why would it be useful to control my Jacuzzi *from outside my home*??? I mean, it's not like I can teleport into the hottub from 200 km/miles away, after setting it to a comfortable temperature.
Watching the last episode of the Gadget Show, one of the Air Fryers on tests was controlled by an app, FFS!! And I mean *all* of the settings, as far as I could see, no manual controls other than an on/off switch ie a "sleep button". This is a device you really should not be controlling remotely. They didn't specify how the phone talked to the Air Fryer, so I suppose it could be BlueTooth, but I suspect it's a cloud connected server a few 1000 miles away where they can record exactly when and how you use it.
"outside the home" could also mean putting it in your garden and controlling it with your phone whilst you're in it............. "More bubbles Cutie Pie? Damn, that's the third iPhone I've dropped in it this month!"
If the temperature goes high enough, you could also brew beer in it whilst you're out.