IDCF Cloud, operated by SoftBank subsidiary IDC Frontier, suffered a ransomware attack around 3:40 AM on October 7, causing some virtual servers in the eastern Japan region to stop and become unresponsive.

The attack impacted four availability zones in eastern Japan: tesla, henry, pascal, and joule, affecting a total of 495 enterprises and municipalities. The company confirmed difficulties in extracting and recovering customer data in the affected areas and advised customers to rebuild using their own backups in other environments. The company has isolated the eastern Japan region from the network and suspended management consoles in other regions to prevent secondary damage, subsequently establishing an emergency response headquarters in collaboration with its parent company, SoftBank.

The attackers claimed in a public statement that they completed encryption of the eastern Japan region in just 7 minutes, asserting access to approximately 239 systems running virtual machines, encrypting 225 large storage systems (about 3.6 PB of data), blocking over 16,600 virtual machine disks, and deleting 554,153 backup snapshots. The statement also mentioned leaving multiple ransom notes in the system and mocking the operations staff for not detecting the breach within hours.

Affected customers include the Ibaraki Prefectural Office and police website, which are inaccessible, interruptions in inbound and outbound shipments at the Nippon Suisan Logistics cold storage, and JR East and View Card potentially involving access to about 6.09 million email-related records, while JR Kyushu reported about 1.3 million member email addresses may be affected. The company is contacting affected customers one by one and collaborating with external security firms to investigate the intrusion path.

Other regions, including the remaining radian and newton zones in eastern Japan, as well as the second and third zones in eastern Japan and the first zone in western Japan, have not yet confirmed unauthorized access. The company stated it is developing a recovery plan and advancing investigations and customer migration assistance with support from SoftBank's technology department.

Market Mechanism: Sovereign cloud and domestic alternative cloud service providers, due to their centralized hosting of small and medium enterprises and municipal systems, have become high-value targets for attacks, with financial and business continuity risks spreading from individual customers to the upstream and downstream of the industry chain. Affected enterprises must bear the costs of backup reconstruction and migration, while cloud service providers face reputational damage and customer loss pressure. Customers with independent backups and multi-cloud architectures are relatively less pressured, while security services and backup vendors are experiencing a short-term increase in demand.

Source: Public Information