IDCF Cloud Operated by SoftBank Subsidiary IDC Frontier Hit by Ransomware Attack, Affecting 495 Enterprises and Municipalities
IDCF Cloud, operated by SoftBank subsidiary IDC Frontier, suffered a ransomware attack around 3:40 AM on October 7, causing some virtual servers in the eastern Japan region to stop and become unresponsive.
The attack impacted four availability zones in eastern Japan: tesla, henry, pascal, and joule, affecting a total of 495 enterprises and municipalities. The company confirmed difficulties in extracting and recovering customer data in the affected areas and advised customers to rebuild using their own backups in other environments. The company has isolated the eastern Japan region from the network and suspended management consoles in other regions to prevent secondary damage, subsequently establishing an emergency response headquarters in collaboration with its parent company, SoftBank.
The attackers claimed in a public statement that they completed encryption of the eastern Japan region in just 7 minutes, asserting access to approximately 239 systems running virtual machines, encrypting 225 large storage systems (about 3.6 PB of data), blocking over 16,600 virtual machine disks, and deleting 554,153 backup snapshots. The statement also mentioned leaving multiple ransom notes in the system and mocking the operations staff for not detecting the breach within hours.
Affected customers include the Ibaraki Prefectural Office and police website, which are inaccessible, interruptions in inbound and outbound shipments at the Nippon Suisan Logistics cold storage, and JR East and View Card potentially involving access to about 6.09 million email-related records, while JR Kyushu reported about 1.3 million member email addresses may be affected. The company is contacting affected customers one by one and collaborating with external security firms to investigate the intrusion path.
Other regions, including the remaining radian and newton zones in eastern Japan, as well as the second and third zones in eastern Japan and the first zone in western Japan, have not yet confirmed unauthorized access. The company stated it is developing a recovery plan and advancing investigations and customer migration assistance with support from SoftBank's technology department.
Market Mechanism: Sovereign cloud and domestic alternative cloud service providers, due to their centralized hosting of small and medium enterprises and municipal systems, have become high-value targets for attacks, with financial and business continuity risks spreading from individual customers to the upstream and downstream of the industry chain. Affected enterprises must bear the costs of backup reconstruction and migration, while cloud service providers face reputational damage and customer loss pressure. Customers with independent backups and multi-cloud architectures are relatively less pressured, while security services and backup vendors are experiencing a short-term increase in demand.
Source: Public Information
ABAB AI Insight
IDC Frontier is a data center and cloud service provider under SoftBank, focusing on domestic sovereign cloud in Japan, positioned as a domestic alternative to AWS, Azure, and Google Cloud, primarily serving small and medium enterprises and municipalities. SoftBank has previously expanded its technology portfolio through investments in OpenAI while retaining domestic infrastructure assets. This attack concentrated on multiple availability zones within a single region, indicating that the attackers targeted virtualization and storage layers rather than a single tenant.
From a capital perspective, SoftBank holds IDCF as a domestic cloud infrastructure, with customers operating official websites, logistics, and public services through it. After the attack, the company relied on resources from its parent company to establish an emergency headquarters and guide customers to migrate to other environments, shifting resources from daily operations to isolation, investigation, and customer support. The attackers increased recovery costs by encrypting storage and deleting snapshots, forcing customers to rely on external backups.
This is similar to previous large-scale ransomware incidents targeting cloud service providers or hosting providers, where attacks on other regional clouds or hosting providers led to downstream service interruptions. Currently, domestic sovereign clouds are in an expansion phase, attempting to attract customers with data localization requirements, but the concentrated deployment in a single region makes them a high-value attack surface.
Essentially, this represents a restructuring of the industry chain. Cloud infrastructure centralizes multi-customer computing and storage on a shared virtualization layer, allowing attackers to simultaneously impact hundreds of downstream entities with a single intrusion, shifting recovery responsibility from the service provider to the customer's own backups and multi-cloud reconstruction. Therefore, the domestic cloud alternative path faces a repricing of security and resilience, with capital potentially shifting from a single domestic supplier to architectures with independent backups, regional redundancy, or multi-cloud strategies.
ABAB News · Cognitive Law
A shared infrastructure intrusion can simultaneously breach hundreds of downstream entities.
After backup deletion, recovery responsibility shifts from the service provider to the customer's own copies.
Concentrated hosting of sovereign clouds amplifies the industry chain's diffusion range of single point failures.