First of all does your device have any in-field programming ability?
Perhaps the code that does this failed some how.
If the device has truly gone total blank and you are 100% sure it was programmed, you might question your programming method and see if there is something not right with, because even if you protect it, it can still be erased, either on purpose or due to incorrect programming.
Please also make this points clear:
Is the device totally blank or random data?
You mention both totally blank and data corruption.
Are you able to re-program them?
What are the stresses at the customer site - specifically is that a hi or lo temperature situation?
Are you able to reproduce failure?