Ransomware attack disrupts Japan's IDCF Cloud used by govt clients

IDC Frontier disclosed a ransomware attack on its IDCF Cloud infrastructure-as-a-service platform affecting the East Japan Region 1 data center cluster. The attack began on October 7, 2026, forcing a shutdown of network and systems to contain the compromise. The threat actor claimed encryption of 225 databases totaling 3.6 PB of data, compromise of 239 hypervisors, sealing of 16,000 VM disks, and wiping of over half a million snapshots. The attack impacted 495 companies and local governments using the cloud service. IDC Frontier isolated affected systems, disabled management console access across all regions, and is investigating the intrusion route and scope. The company is verifying security before restoring customer access. A separate outage at Nissui Logistics due to suspected unauthorized access is under investigation but not confirmed related. The incident reflects a broader increase in cybersecurity incidents targeting Japanese organizations, with attackers exploiting known vulnerabilities and weaknesses in access controls, potentially facilitated by AI tools.

The ransomware attack caused a significant service outage in the East Japan Region 1 data center cluster of IDCF Cloud, disrupting operations for 495 companies and local governments. Large volumes of data and virtual machine resources were encrypted or wiped, impacting availability and potentially causing data loss. Customer management console access was disabled across all regions as a precaution. The incident highlights risks to cloud infrastructure services and their dependent clients. The related outage at Nissui Logistics may indicate broader supply chain or third-party risks but remains unconfirmed as connected. The attack contributes to a rising trend of cybersecurity incidents in Japan, affecting critical infrastructure and business continuity.

As this is a ransomware attack on a cloud service, IDC Frontier has isolated and shut down affected systems to prevent further spread and disabled customer management console access while verifying security. Customers should follow IDC Frontier's guidance and await notification that systems are secure before resuming access. No specific patch or fix is applicable since this is an active incident response to a ransomware compromise. Organizations using the service should monitor vendor communications for updates. No additional mitigation steps are recommended until the vendor completes its investigation and remediation.