IDCF Cloud Confirms Ransomware Attack on East Japan Region 1
IDC Frontier, a subsidiary of SoftBank Group and operator of Japan’s IDCF Cloud infrastructure-as-a-service platform, disclosed on October 8, 2026, that its IDCF Cloud service was targeted in a ransomware attack beginning at 3:40 AM local time on October 7, 2026. The attack specifically impacted East Japan Region 1, prompting the company to isolate and shut down affected systems to prevent further spread of the compromise.
In an official announcement, IDC Frontier stated: "Our investigation has determined that a disruption in East Japan Region 1 was caused by a ransomware attack by a third party." The company added that it continues to investigate the precise cause and full scope of the impact, while working to identify and block the intrusion route and assess security across other regions.
Impact on 495 Clients and Infrastructure Claims
The ransomware incident disrupted services for 495 companies and local government entities relying on IDCF Cloud for virtual servers, storage, and networking to run websites, applications, and business systems. IDC Frontier confirmed that customer access to management consoles was proactively disabled across all regions as a precautionary measure while security verification proceeds, with restoration planned only after confirming safety.
Screenshots shared by customers prior to being locked out of the console revealed a message from the threat actor claiming they breached IDCF Cloud’s East Japan Region 1 infrastructure in just seven minutes. According to the message, the attackers encrypted 225 databases corresponding to 3.6 petabytes of data, reached 239 hypervisors, sealed 16,000 virtual machine disks, and wiped 554,153 snapshots.
Related Incident: Nissui Logistics Outage Raises Connection Questions
In a related development, Japanese marine products company Nissui Corporation reported that its logistics subsidiary, Nissui Logistics, experienced a system outage due to suspected unauthorized access to a third-party data center it uses. The outage has halted goods shipments and receipts, and Nissui is investigating whether personal or customer data was leaked. The company employs approximately 11,500 individuals and operates an international supply chain covering fishing, aquaculture, processing, and sales. It remains unconfirmed whether this incident is connected to the IDCF Cloud attack.
Broader Trend: Rising Cyberattacks in Japan Linked to AI-Powered Reconnaissance
According to Macnica researcher Yutaka Sejiyama, Japanese organizations have faced an increasing number of cybersecurity incidents in 2026. Since January 1, Macnica recorded 119 incidents involving personal information theft or exposed data, with 83 occurring between July 1 and October 6. For comparison, the same period in 2025 saw 84 incidents, and the full year of 2024 recorded just 62.
Sejiyama noted that attackers are increasingly probing websites and APIs for access-control, configuration, and authentication weaknesses, exploiting known (n-day) vulnerabilities. He observed that while identifying such weaknesses traditionally required significant time and effort — making smaller targets less attractive — the emergence of capable, low-cost AI tools is now enabling broad, rapid exploration of security flaws, shifting the threat landscape.
The rise of capable, cheap AI tools may be the reason why broad, detailed exploration of security weaknesses is now changing the landscape.
Context and Response
IDCF Cloud, operated by IDC Frontier, provides critical cloud infrastructure to Japanese businesses and government agencies. The disruption in East Japan Region 1 highlights vulnerabilities in regional cloud services and underscores the growing threat of ransomware targeting essential digital infrastructure. As of the disclosure, IDC Frontier had not attributed the attack to a specific ransomware group or disclosed whether any ransom demand was made.
The company emphasized ongoing efforts to secure its platforms, validate system integrity, and restore services safely. Customers are advised to monitor official channels for updates on service restoration and security advisories.
Source: BleepingComputer