Ransomware attack disrupts Japan’s IDCF Cloud service

Japanese cloud provider IDC Frontier says a ransomware attack disrupted its IDCF Cloud service, causing an outage in a data center cluster serving eastern Japan.

The company said the attack began on October 7 at 3:40 a.m. local time. It attributed the disruption in East Japan Region 1 to a third-party ransomware attack and said it was investigating the cause and scope of the impact. The incident affects 495 companies and local governments that use the service.

IDC Frontier isolated and shut down affected systems to contain the intrusion. It also disabled customer access to management consoles across all regions while checking their security. The company said it would restore access after confirming it was safe and is working to identify and block the intrusion route.

Screenshots taken before customers lost console access showed a threat actor claiming it took seven minutes to breach the infrastructure. The actor claimed to have encrypted 225 databases containing 3.6 PB of data, reached 239 hypervisors, sealed 16,000 virtual machine disks, and wiped 554,153 snapshots. These figures are claims by the threat actor, not independently confirmed findings.

IDC Frontier is a subsidiary of SoftBank Group. Separately, Japanese seafood company Nissui said its logistics subsidiary had a system outage after suspected unauthorized access to a third-party data center. It is investigating whether personal or customer data was leaked. The source says it is unclear whether that outage is connected to the IDCF Cloud attack.