Ransomware Strike on Japanese Cloud Provider Impacts Hundreds of Clients
A ransomware attack on IDC Frontier's IDCF Cloud service disrupted operations for 495 companies and local governments in Japan, according to a company announcement. The attack began October 7 at 3:40 AM local time, forcing IDC Frontier to shut down network and system components in its East Japan Region 1 data center cluster. IDCF Cloud, operated by a SoftBank Group subsidiary, provides infrastructure-as-a-service to clients running websites, applications and business systems. The company isolated affected systems to stop the attack from spreading and suspended customer console access in all regions while verifying their security.
Attack Scope and Company Response
IDC Frontier confirmed that the ransomware attack affected its East Japan Region 1 infrastructure and that 495 organizations using IDCF Cloud experienced disruption. The company stated it is investigating the precise cause and the full extent of the compromise.
After detecting the intrusion, IDC Frontier isolated and shut down affected systems to contain the attack. The company disabled customer access to management consoles across all regions as a precaution and stated it will restore access after confirming security. IDC Frontier continues to identify the intrusion route and verify security in other regions.
Attacker Claims and Technical Impact
Screenshots of messages visible to customers before console lockout showed an attacker claim that the breach of East Japan Region 1 infrastructure took seven minutes. The threat actor stated they encrypted 225 databases totaling 3.6 petabytes of data, reached 239 hypervisors, sealed 16,000 virtual machine disks and wiped 554,153 snapshots.
IDC Frontier has not independently verified these figures in its public statements. The company's announcement focuses on containment and investigation rather than confirming the scale of data encryption or destruction claimed by the attacker.
Nissui Logistics Outage Reported Separately
Japanese seafood company Nissui Corporation announced that Nissui Logistics, its logistics subsidiary, experienced a system outage because of suspected unauthorized entry into a third-party data center the subsidiary uses. The disruption stopped goods shipment and receipt, and Nissui is investigating whether personal information or customer data was exposed.
The source does not establish whether the Nissui outage is connected to the IDCF Cloud attack. Nissui has approximately 11,500 employees and operates an international supply chain covering fishing, aquaculture, processing and sales.
Rising Cyberattack Trend in Japan
Macnica researcher Yutaka Sejiyama reported that Japanese companies have faced an increase in cyberattacks. Macnica logged 119 cybersecurity incidents involving personal information theft or exposed data, with 83 occurring between July 1 and October 6.
The security firm recorded 84 incidents in 2025 and 62 throughout 2024 using the same criteria. Analysis shows attackers are probing websites and APIs for access-control, configuration and authentication weaknesses, and exploiting known vulnerabilities.
AI Tools and Evolving Attack Methods
Sejiyama told BleepingComputer that finding security weaknesses specific to individual websites traditionally required considerable time and effort, making small targets less attractive to attackers. The rise of capable and inexpensive AI tools may enable broad, detailed exploration of security weaknesses at scale.
This shift may lower the cost and expertise barrier for attackers to identify and exploit configuration errors, weak authentication and unpatched software across a wider range of targets, including smaller organizations that were previously less attractive to compromise.
What Organizations Using Cloud Services Should Do
Organizations that rely on third-party infrastructure should confirm with their providers whether their systems are affected and what containment measures are in place. Check whether you have recent, offline backups that cannot be reached by an attacker who compromises your cloud environment, and test restoring from them.
Review access controls for cloud management consoles and API keys. Implement multi-factor authentication for all administrative accounts, restrict console access by IP address where possible and audit which users have permissions to create, modify or delete resources. Monitor for unusual activity in cloud logs, including bulk deletions of snapshots or backups.
- Confirm with your cloud provider whether your systems are affected and what containment measures are in place.
- Check whether you have recent, offline backups and test restoring from them.
- Review access controls for cloud management consoles and API keys.
- Implement multi-factor authentication for all administrative accounts.
- Restrict console access by IP address where possible.
- Audit which users have permissions to create, modify or delete resources.
- Monitor cloud logs for unusual activity, including bulk deletions of snapshots or backups.
Questions readers ask
How many organizations were affected by the IDCF Cloud ransomware attack?
IDC Frontier stated that 495 companies and local governments using its IDCF Cloud service were impacted by the ransomware attack on the East Japan Region 1 infrastructure. The company isolated affected systems and suspended customer console access across all regions while verifying security.
What did the attackers claim they encrypted or deleted?
Messages visible to customers claimed the attackers encrypted 225 databases totaling 3.6 petabytes of data, reached 239 hypervisors, sealed 16,000 virtual machine disks and wiped 554,153 snapshots. IDC Frontier has not confirmed these figures in its public announcement.
Is the Nissui Logistics outage connected to the IDCF Cloud attack?
The source does not establish whether the Nissui Logistics outage, caused by suspected unauthorized access to a third-party data center, is related to the IDCF Cloud ransomware attack. Both incidents occurred around the same time, but no connection has been confirmed.
Why are cyberattacks increasing in Japan?
Macnica researcher Yutaka Sejiyama noted that attackers are probing websites and APIs for access-control and authentication weaknesses and exploiting known vulnerabilities. The rise of capable, inexpensive AI tools may enable attackers to explore security weaknesses at scale, lowering the barrier to targeting smaller organizations.
What should I do if my organization uses a cloud provider that was attacked?
Contact your provider to confirm whether your systems are affected and what containment steps are active. Verify that you have recent, offline backups that an attacker cannot reach through your cloud account, and test restoring from them. Review and strengthen access controls for cloud management consoles, enable multi-factor authentication and audit user permissions.
Source and reporting limits
Based on reporting by BleepingComputer. This automated brief is not independent verification. Claims are attributed to the reporting source; later developments may change the picture.