Ransomware attack knocks out Japan's IDCF Cloud

IDC Frontier, a major Japanese cloud operator and a subsidiary of the SoftBank holding group, says its IDCF Cloud service was targeted in a ransomware attack. The incident caused an outage at a data center cluster serving the eastern part of the country.

According to the company, the attack began on October 7 at 3:40 AM local time and forced a shutdown of the network and systems. "Our investigation has determined that a disruption in East Japan Region 1 was caused by a ransomware attack by a third party," the firm said, adding that it is still establishing the precise cause and the scope of the impact.

The attack affects 495 companies and local governments that rely on the service. IDCF Cloud is an infrastructure-as-a-service platform: customers rent virtual servers, storage, and networking to run websites, applications, and business systems in Japanese data centers.

After detecting the attack, IDC Frontier isolated and shut down the affected systems in East Japan Region 1 to stop the compromise from spreading. The company is now working to identify and block the intrusion route and to check security in its other regions. As a precaution, it has disabled customer access to management consoles across all regions until their safety is confirmed.

What the attackers claim

Screenshots taken by customers before the consoles were locked show a message from the threat actor. It claims that breaching the East Japan Region 1 infrastructure took just seven minutes. The attackers say they encrypted 225 databases totaling 3.6 PB of data, reached 239 hypervisors, sealed 16,000 VM disks, and wiped 554,153 snapshots.

Nissui also hit

A day earlier, Japanese seafood company Nissui reported an outage of its own: its logistics subsidiary, Nissui Logistics, was affected by suspected unauthorized access to a third-party data center it uses. As a result, goods are neither being shipped nor received, and the company is checking whether personal or customer data was leaked. Nissui employs around 11,500 people. It is unclear whether its outage is linked to the IDCF Cloud attack.

A wave of attacks and the role of AI

Macnica researcher Yutaka Sejiyama notes that a string of major Japanese firms has recently come under fire. Since the start of the year, the firm has logged 119 incidents involving the theft or exposure of personal data, 83 of them between July 1 and October 6. For comparison, it recorded 84 such cases across all of 2025 and just 62 in 2024.

Analysis shows attackers probing websites and APIs for access-control, configuration, and authentication weaknesses and exploiting known (n-day) vulnerabilities. Sejiyama says that hunting for flaws specific to an individual site has traditionally demanded considerable time and effort, which made small targets unattractive. The rise of cheap, capable AI tools may be why broad, detailed exploration of security weaknesses is now reshaping the landscape.

Source: Bleeping Computer