An IDCF Cloud ransomware attack has disrupted services used by 495 companies and local governments in Japan. Operator IDC Frontier shut down affected infrastructure after detecting the incident in its East Japan Region 1 environment.
The company says the attack began at 3:40 a.m. local time on October 7. Investigators are still determining how the attackers gained access and the full extent of the damage.
IDC Frontier Isolates Affected Cloud Systems
IDC Frontier, a SoftBank Group subsidiary, provides virtual servers, storage and networking through its IDCF Cloud platform. Customers use these services to operate websites, applications and business systems in Japanese data centers.
After discovering the intrusion, the company isolated affected systems and disconnected their network access to contain the compromise.
Meanwhile, security teams began working to identify and block the entry point. They also started checking infrastructure in other regions for potential security problems.
As a precaution, IDC Frontier disabled customer access to management consoles across all regions. The company plans to restore that access once it confirms the consoles are safe to use.
This wider restriction does not establish that attackers compromised every region.
Attackers Claim Extensive Damage to Cloud Infrastructure
Before console access closed, customers captured screenshots of a message apparently left by the attackers.
The message claimed the group breached East Japan Region 1 in seven minutes. It also alleged that the attack encrypted 225 databases representing 3.6 petabytes of data.
Additional claims included access to 239 hypervisors, the locking of 16,000 virtual machine disks and the deletion of 554,153 snapshots.
However, these figures come from the attackers. The supplied company statements do not independently confirm the claimed scale of destruction.
The IDCF Cloud ransomware investigation therefore remains central to establishing which systems and customer resources suffered damage.
Nissui Logistics Reports a Separate Outage
Separately, Japanese seafood and food company Nissui disclosed a system outage at its logistics subsidiary on October 7.
Nissui Logistics linked the disruption to suspected unauthorized access at a third-party data center it uses. As a result, the subsidiary could neither ship nor receive goods.
The company is also investigating whether the incident exposed personal information or customer data.
However, no confirmed connection currently links the Nissui Logistics outage to the attack on IDCF Cloud.
Nissui employs approximately 11,500 people and operates an international supply chain covering fishing, aquaculture, processing and sales.
Reported Data Incidents Rise Across Japan
The disruption comes amid an increase in recorded cybersecurity incidents affecting Japanese organizations.
Security firm Macnica counted 119 incidents involving personal information theft or exposed data from the start of 2026 through October 6. Of those, 83 occurred between July 1 and October 6.
By comparison, the company recorded 84 incidents during all of 2025 and 62 in 2024 using the same criteria.
Its analysis points to attackers examining websites and APIs for weaknesses in access controls, configurations and authentication. They also exploit known vulnerabilities.
Macnica researcher Yutaka Sejiyama suggested that inexpensive, capable AI tools may be making detailed searches for website weaknesses more practical.
However, that remains a possible explanation for the broader trend. It does not establish that AI played a role in the IDCF Cloud intrusion.
0 responses to “IDCF Cloud Ransomware Attack Disrupts 495 Japanese Organizations”