A ransomware intrusion has disrupted IDCF Cloud, the infrastructure-as-a-service platform operated by IDC Frontier, a subsidiary of Tokyo-based SoftBank Group. The attack targeted a data center cluster serving Japan's eastern region, forcing the company to shut down affected systems and isolate infrastructure to contain the breach.
The incident began on October 7 at 3:40 AM local time. According to IDCF Cloud's statement, "Our investigation has determined that a disruption in East Japan Region 1 was caused by a ransomware attack by a third party." The company noted that "We are continuing to investigate the precise cause and the scope of the impact."
The attack has affected 495 companies and local governments relying on IDCF Cloud's virtual servers, storage, and networking services to operate websites, applications, and business systems. In response, IDC Frontier has disabled customer access to management consoles across all regions while conducting security verification, with restoration planned once safety is confirmed.
Evidence from customer screenshots captured before console lockout shows a message from the attacker claiming the breach of East Japan Region 1 took seven minutes. The threat actor claims to have encrypted 225 databases representing 3.6 PB of data, compromised 239 hypervisors, sealed 16,000 VM disks, and wiped 554,153 snapshots.
IDC Frontier is currently working to identify and block the intrusion vector while assessing security posture in other regions.
Broader pattern of attacks on Japanese organizations
The IDCF Cloud incident comes amid a surge in cyberattacks targeting Japanese enterprises. Nissui Corporation, a major seafood and food company with approximately 11,500 employees, disclosed that its logistics subsidiary experienced a system outage due to suspected unauthorized access to a third-party data center. The disruption has halted shipping and receiving operations, and the company is investigating potential leaks of personal and customer information. It remains unclear whether the Nissui incident is connected to the IDCF Cloud attack.
Security researcher Yutaka Sejiyama from Macnica has documented a sharp increase in cybersecurity incidents across Japan. The firm logged 119 incidents involving personal information theft or data exposure from January through October 6, with 83 of those occurring between July 1 and October 6. By comparison, Macnica recorded 84 incidents in 2025 using the same measurement criteria, and 62 throughout 2024.
Analysis of these incidents reveals that attackers are systematically probing websites and APIs for access-control, configuration, and authentication flaws, while also leveraging known vulnerabilities. Sejiyama explained to BleepingComputer that historically, identifying weaknesses in individual targets required substantial time and resources, making smaller organizations less appealing targets. The proliferation of capable and affordable AI tools may be shifting this calculus, enabling attackers to conduct broader and more detailed security reconnaissance at lower cost.