Ransomware Attack Disrupts Japan's IDCF Cloud, Affecting 495 Companies and Government Clients

Ransomware Attack on IDCF Cloud

IDC Frontier, a Japanese cloud and digital infrastructure provider, disclosed a ransomware attack on its IDCF Cloud service. The incident began on October 7 at 3:40 AM local time, leading to a network and system shutdown in its East Japan Region 1 data center cluster. The company confirmed the disruption was caused by a third-party ransomware attack.

Impact on Customers and Services

The attack has affected 495 companies and local government entities that utilize IDCF Cloud's infrastructure-as-a-service platform. IDC Frontier, a subsidiary of SoftBank Group, provides virtual servers, storage, and networking. Following detection, impacted systems were isolated and shut down to prevent further spread. Customer access to management consoles has been proactively disabled across all regions for security verification.

Threat Actor Claims and Ongoing Investigation

Screenshots from customers indicate the threat actor claimed to have breached the infrastructure in seven minutes. They assert encryption of 225 databases (3.6 PB of data), access to 239 hypervisors, sealing of 16,000 VM disks, and wiping of 554,153 snapshots. IDC Frontier is continuing its investigation into the precise cause and full scope of the impact, working to identify and block the intrusion route and verify security in other regions.

Related Incidents

Separately, Nissui Corporation, a Japanese marine products company, reported a system outage at its logistics subsidiary, Nissui Logistics, due to suspected unauthorized access at a third-party data center. This outage has halted goods shipping and receiving. It is currently unclear if this incident is connected to the ransomware attack on IDCF Cloud.