Ransomware attack on SoftBank unit's cloud affects 495 firms, municipalities
In short
IDC Frontier, a SoftBank subsidiary, said part of its IDCF Cloud service was hit by unauthorized access that caused an outage from around 03:40 on October 7. The affected area is the East Japan Region 1, served by a data center in Shirakawa, Fukushima Prefecture. Nikkei, ITmedia and TBS reported the impact reached 495 companies and municipalities, with Ibaraki Prefecture and Nissui group's Nissui Logistics among those reporting disruption.
Read the full story 2 min read
IDC Frontier, a SoftBank subsidiary that runs corporate cloud services, said on October 7 that part of its IDCF Cloud systems had been subject to unauthorized access and that some of its services were disrupted. The company said the unauthorized access occurred around 03:40 the same day. NHK and Nikkei reported the company identified the attack as ransomware. [ 1 , 2 , 3 , 5 , 7 , 9 ]
The affected area was the East Japan Region 1, served by a data center in Shirakawa, Fukushima Prefecture, according to ITmedia and Nikkei. IDC Frontier said IDCF Cloud operates three regions in eastern Japan and one in western Japan, and that it was also checking the safety of areas that were not affected. It said it had finished cutting off networks and halting systems, and was working to identify the intrusion route and carry out recovery. [ 1 , 2 , 3 , 7 ]
Nikkei, ITmedia and TBS reported that the impact reached 495 companies and municipalities. Nikkei said Ibaraki Prefecture and Ibaraki Prefectural Police could not be viewed online, and that while some of the prefecture's information distribution and electronic bidding functions were affected, operations were not seriously disrupted. Several private companies also said service delivery or inventory management was disrupted. [ 7 , 8 , 9 ]
Nissui said its group cold-logistics company Nissui Logistics suffered a system failure and could not handle inbound or outbound goods at all 17 of its warehouses. Nissui said the cause appeared to be unauthorized third-party access to a contracted data center used by Nissui Logistics, which uses IDC Frontier's service. [ 7 , 10 ]
IDC Frontier said it was notifying affected customers individually and was moving to identify the attacker and clarify the full extent of the damage, alongside recovery work. It released a comment apologising for “great concern and inconvenience,” according to Nikkei. Nikkei reported that the company said the status of any information leak was still under confirmation and that, as of the evening of October 7, no recovery timetable had been set. [ 1 , 2 , 3 , 7 ]
The early tech reports from ITmedia, ASCII.jp and Keitai Watch described unauthorized access and an outage but did not mention ransomware; NHK and Nikkei later reported the attack as ransomware. ITmedia also reported that some affected parties received notices that restoration would be “difficult,” a detail not confirmed in the other documents. [ 1 , 2 , 3 , 5 , 7 , 8 ]
Why it matters
The outage hit a corporate cloud service used by hundreds of companies and local governments, with effects showing up in public websites, electronic bidding and cold-chain logistics. IDC Frontier, a SoftBank subsidiary, said as of the evening of October 7 it had no recovery timeline, leaving affected organizations unable to say when services would return.
Key facts
- IDC Frontier, a SoftBank subsidiary, said part of its IDCF Cloud systems was hit by unauthorized access and that some services were disrupted. [ 1 , 2 , 3 , 5 , 9 ]
- The company said the unauthorized access occurred around 03:40 on October 7. [ 1 , 2 , 3 , 7 , 9 ]
- The affected area was the East Japan Region 1, served by a data center in Shirakawa, Fukushima Prefecture. [ 1 , 7 ]
- Nikkei, ITmedia and TBS reported that 495 companies and municipalities using the service were affected. [ 7 , 8 , 9 ]
- Ibaraki Prefecture and Ibaraki Prefectural Police said their websites could not be viewed, and some information and electronic bidding functions were affected. [ 7 ]
- Nissui said its group cold-logistics company Nissui Logistics suffered a system failure and could not handle inbound and outbound goods at all 17 of its warehouses. [ 7 ]
- IDC Frontier said it had finished cutting off networks and halting systems and was working to identify the intrusion route and restore services, while checking the safety of unaffected areas. [ 1 , 2 , 3 , 7 ]
- As of the evening of October 7, the company said it had no recovery timeline, and the status of any information leak was still under confirmation, according to Nikkei. [ 7 ]
Confirmed by several sources
- IDC Frontier announced on October 7 that part of its IDCF Cloud systems was subject to unauthorized access and that some services were disrupted. [ 1 , 2 , 3 , 5 , 9 ]
- The unauthorized access occurred around 03:40 on October 7. [ 1 , 2 , 3 , 7 , 9 ]
- The affected area was the East Japan Region 1, served by a data center in Shirakawa, Fukushima Prefecture. [ 1 , 7 ]
- The company said it was contacting affected customers individually. [ 1 , 2 , 3 , 7 ]
- IDC Frontier said it was investigating to resolve the outage and checking the safety of areas that were not affected. [ 1 , 2 , 3 , 7 ]
- The impact reached 495 companies and municipalities, according to Nikkei, ITmedia and TBS. [ 7 , 8 , 9 ]
Still unclear
- Whether the attack involved ransomware The first tech reports described only unauthorized access; NHK and Nikkei later reported the company said it was a ransomware attack.
- Whether any information leaked Nikkei reported the company said it was still confirming whether information had leaked.
- When services will be restored Nikkei reported that as of the evening of October 7 no recovery timetable had been set.
- Who carried out the attack and how they got in Documents say the intrusion route is being identified and the attacker is not named.
- Whether some users were told data could not be restored ITmedia reported some affected parties received notices that restoration was “difficult,” a claim not confirmed by the company in the other documents.
- Nissui said Nissui Logistics, which uses IDC Frontier's service, suffered a system failure that halted goods handling at its 17 warehouses. Reported by a single source so far
What local media are saying
Timeline, local time
- Unauthorized access is detected, later described by the company and NHK as a ransomware attack, affecting IDCF Cloud systems. [ 1 , 2 , 3 , 5 , 7 , 9 ]
- ITmedia reports the unauthorized access and an outage in the East Japan Region 1. [ 1 ]
- NHK reports that IDC Frontier's systems were hit by a ransomware attack and that part of its cloud service is disrupted. [ 5 ]
- Nikkei reports that 495 companies and municipalities are affected, that Ibaraki Prefecture's website is unavailable and that Nissui Logistics' systems failed, and that no recovery timetable exists. [ 7 ]
- ITmedia reports the attack was ransomware, that 495 companies and municipalities are affected, and that some were told restoration is difficult. [ 8 ]
- Nippon TV reports on the cyberattack damage at IDC Frontier and Nissui group's Nissui Logistics. [ 10 ]