Skip to content
Today
Sections

Security Independently confirmed3 publishers 2 min read Published Updated

Ransomware in one IDCF Cloud region hits 495 companies and local governments

IDC Frontier says ransomware in its IDCF Cloud East Japan Region 1 has affected 495 companies and local governments using the service. The SoftBank Group subsidiary has also locked customers out of management consoles in every region while it verifies their security.

The Watch · Security desk

Send a correction

Illustration accompanying Ransomware in one IDCF Cloud region hits 495 companies and local governments
Generated illustration

What happened

  • The attack began at 3:40 AM local time on October 7 and forced a shutdown of the network and systems in East Japan Region 1.
  • Screenshots customers took before the console lockout show a message in which the attacker claims it needed seven minutes to breach the region.
  • The attacker also claims it encrypted 225 databases holding 3.6 PB, reached 239 hypervisors, sealed 16,000 VM disks and wiped 554,153 snapshots.
  • Nissui Logistics stopped shipping and receiving goods after suspected unauthorized access to a third-party data center it uses.

Why it matters

  • What it limits constraint IDC Frontier's own containment is part of the outage: shutting the region to stop the spread took tenants' hosted systems offline whether or not the attacker reached each one.
  • What it costs cost If the snapshot claim holds, tenants that used IDCF Cloud snapshots as their backups have lost those recovery points and must restore from copies kept off the platform.
  • Who's exposed exposure Until the intrusion route is identified and blocked, customers in IDC Frontier's other regions cannot rule out the same path into their own environments.

IDC Frontier has confirmed the ransomware and the customer count [1][4]. "Our investigation has determined that a disruption in East Japan Region 1 was caused by a ransomware attack by a third party," the company said in its announcement [3]. "We are continuing to investigate the precise cause and the scope of the impact," it added [14].

The company did not publish figures for encrypted data, hypervisors or snapshots. Those numbers come from the attacker's own message, which customers captured in screenshots [9][10]. They are the attacker's claims until IDC Frontier confirms or disputes them.

IDCF Cloud rents out virtual servers, storage and networking, and customers use them to run websites, applications and business systems in Japanese data centers [6]. The attacker says it reached 239 hypervisors [10]. If that is accurate, the intruder was working at the layer that runs those virtual servers. One breach there was enough to disrupt 495 companies and local governments [4].

For tenants, the snapshot claim matters most because it decides how they recover. Set 554,153 wiped snapshots against 16,000 sealed disks and the attacker is claiming about 35 recovery points destroyed for every disk it locked [18].

BleepingComputer reports that it is unclear whether the Nissui Logistics outage is connected to the IDCF attack [13]. Nissui, a seafood and food group with about 11,500 employees, is investigating whether personal information or customer data leaked [12].

The wider count from Macnica covers a different kind of incident: personal-data theft or exposed data [15]. The security firm logged 119 such incidents since the start of the year, 83 of them between July 1 and October 6 [15]. That leaves 36 for the first six months [20]. Under the same criteria it counted 84 in all of 2025 and 62 in 2024 [16].

In those incidents, attackers probed websites and APIs for access-control, configuration and authentication weaknesses and exploited known vulnerabilities, according to Macnica's analysis [17]. Macnica researcher Yutaka Sejiyama told BleepingComputer that finding weaknesses specific to individual websites has traditionally taken considerable time and effort. That effort made small targets less attractive, he said [21]. BleepingComputer suggests that cheap, capable AI tools may be why that is changing [22].

What to watch

  • IDC Frontier's finding on the intrusion route, and the results of its security checks in regions outside East Japan Region 1.
  • Whether IDC Frontier confirms or disputes the attacker's hypervisor, disk and snapshot figures, and whether customer data was taken as well as encrypted.
  • Whether Nissui names the third-party data center behind its logistics outage.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence62
Adoption55
Hype gap+15
Incentives45
Confidence60

Perspective Coverage

3 publishers
Builder
Builder 27%
Operator
Operator 58%
Investor
Investor 15%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    IDC Frontier disclosed that its IDCF Cloud service was targeted in a ransomware attack that caused an outage at a data center cluster serving eastern Japan, East Japan Region 1.

    Reported SupportedView cited source
  2. [2]

    The attack started on October 7 at 3:40 AM local time, forcing a shutdown of the network and system.

    Reported SupportedView cited source
  3. [3]

    "Our investigation has determined that a disruption in East Japan Region 1 was caused by a ransomware attack by a third party,"

    Reported Supported Source: IDC Frontier announcementView cited source
  4. [4]

    The attack impacts 495 companies and local governments using IDCF Cloud.

    Reported Supported Source: IDC FrontierView cited source
  5. [5]

    IDCF Cloud is operated by IDC Frontier, a subsidiary of SoftBank Group.

    Reported SupportedView cited source
  6. [6]

    IDC Frontier rents out virtual servers, storage and networking that customers use to run websites, applications and business systems in Japanese data centers.

    Reported SupportedView cited source
  7. [7]

    After detecting the attack, IDC Frontier isolated and shut down impacted systems in East Japan Region 1 to prevent the compromise from spreading.

    Reported SupportedView cited source
  8. [8]

    IDC Frontier is working to identify and block the intrusion route and to check security in other regions.

    Reported SupportedView cited source
  9. [9]

    Screenshots taken by customers before they were locked out of the console show a message from the threat actor claiming it took seven minutes to breach East Japan Region 1 infrastructure.

    Reported Supported Source: threat actor claim, via customer screenshots reported by BleepingComputerView cited source
  10. [10]

    The threat actor claims it encrypted 225 databases corresponding to 3.6 PB of data, reached 239 hypervisors, sealed 16,000 VM disks and wiped 554,153 snapshots.

    Reported Supported Source: threat actor claimView cited source
  11. [11]

    Nissui Logistics, a subsidiary of Nissui Corporation, suffered a system outage due to suspected unauthorized access to a third-party data center it uses, and goods are not being shipped or received.

    Reported Supported Source: Nissui CorporationView cited source
  12. [12]

    Nissui, a seafood and food group with approximately 11,500 employees, is investigating whether personal information or customer data was leaked.

    Reported SupportedView cited source
  13. [13]

    It is unclear if the outage at Nissui is connected to the attack on IDCF Cloud.

    Reported Supported Source: BleepingComputerView cited source
  14. [14]

    "We are continuing to investigate the precise cause and the scope of the impact,"

    Reported Supported Source: IDC Frontier announcementView cited source
  15. [15]

    Macnica logged 119 cybersecurity incidents involving personal information theft or exposed data since the start of the year, 83 of them between July 1 and October 6.

    Reported Supported Source: Macnica researcher Yutaka SejiyamaView cited source
  16. [16]

    Using the same criteria, Macnica recorded 84 incidents in 2025 and 62 in 2024.

    Reported Supported Source: MacnicaView cited source
  17. [17]

    Analysis of the incidents shows attackers probing websites and APIs for access-control, configuration and authentication weaknesses, and exploiting known (n-day) vulnerabilities.

    Reported Supported Source: Macnica analysisView cited source
  18. [18]

    The attacker's figures imply about 35 snapshots wiped for every sealed VM disk.

    Derived Supported
  19. [19]

    IDCF Cloud disabled customer access to management consoles for all regions while it verifies their security, and will restore access after confirming it is safe.

    Reported SupportedView cited source
  20. [20]

    Macnica's count implies 36 incidents between the start of the year and June 30.

    Derived Supported
  21. [21]

    Sejiyama told BleepingComputer that finding weaknesses specific to individual websites has traditionally required considerable time and effort, making small targets less attractive.

    Reported Insufficient Source: Yutaka Sejiyama, Macnica, to BleepingComputerView cited source
  22. [22]

    The rise of capable, cheap AI tools may be the reason broad, detailed exploration of security weaknesses is changing.

    Reported Insufficient Source: BleepingComputerView cited source

Sources

3 independent publishers whose own reporting we read for this story.

  1. bleepingcomputer.com

    1 article · October 8, 2026

    Ransomware attack disrupts Japan's IDCF Cloud used by govt clients
  2. dev.to

    1 article · October 7, 2026

    What Are You Sacrificing for Convenience? Rethinking Backups After the IDCF Outage
  3. scworld.com

    1 article · October 11, 2026

    Japanese cloud provider IDC Frontier hit by ransomware attack

Topics and entities

Topics

Entities