Ransomware attack on SoftBank-owned cloud provider IDC Frontier disrupts nearly 500 Japanese organizations

IDC Frontier, a cloud computing subsidiary of SoftBank, said it was hit by a ransomware attack that began around 3:40 a.m. local time on October 7. The company said a third party compromised its IDCF Cloud service and that it shut down the network and systems in its East Japan Region 1 data center as a result.

IDC Frontier said about 495 companies and local government bodies that rely on IDCF Cloud were affected. Reported disruptions touched railway operations, police systems, food logistics, travel services and karaoke and e-commerce businesses. Among the named effects, the email service used by East Japan Railway (JR East) was disrupted, and some prefectural government websites and a news agency were also affected.

The company said virtual servers across four availability zones stopped running and could not be restarted. It warned customers that recovering or restoring data from the affected infrastructure could be difficult, and advised them to prepare a separate environment and rebuild their systems rather than wait for a restoration of the original servers.

As a precaution, IDC Frontier isolated and shut down the affected systems in East Japan Region 1 and disabled customer access to management consoles across all of its regions while it verifies the security of its wider platform. The company has not disclosed how the attackers gained access or named the group responsible, and said it is continuing to investigate the scope of the incident.

The attacker has claimed, according to security researchers, to have encrypted 225 databases totaling about 3.6 petabytes of data and to have compromised numerous virtual machines and snapshots. IDC Frontier has not confirmed those figures, and they should be treated as unverified claims from the attacker rather than established fact.

The incident is a reminder that a single ransomware attack on a cloud provider can cascade into outages across hundreds of unrelated organizations, including public services, at once. Security researchers are still awaiting attribution and a fuller account of how the breach occurred.