Ransomware disrupts IDCF Cloud in Japan

IDC Frontier said its IDCF Cloud service was hit by a ransomware attack that began on 7 October at 3:40 am local time. It said the incident forced it to shut down its network and systems.

The company said its investigation found that the disruption in East Japan Region 1 had been caused by ransomware used by a third party. It said it was still working to establish the exact cause and the extent of the impact.

IDC Frontier said the incident affected 495 companies and local governments that use the service. It isolated the affected systems in East Japan Region 1 and disabled customer access to management consoles across all regions while it checked security.

Screenshots shared by customers before the console lockout showed a message from the threat actor claiming that the intrusion took seven minutes. The same message claimed 225 databases were encrypted, 3.6 petabytes of data were reached, 239 hypervisors were accessed, 16,000 virtual machine disks were sealed, and 554,153 snapshots were wiped.

Nissui Corporation said its logistics subsidiary, Nissui Logistics, had also suffered a system outage after suspected unauthorised access to a third-party data centre. The company said goods were not being shipped or received and that it was investigating whether personal or customer data had been leaked, while it remained unclear whether the outage was connected to the IDCF Cloud incident.