Ransomware Hits IDCF Cloud in Japan, Affecting 495 Companies and Local Governments

IDC Frontier, the Japanese cloud provider behind IDCF Cloud, said in an October 8 update that a ransomware attack beginning around 3:40 a.m. on October 7 has disrupted part of its East Japan Region 1, affecting 495 companies and local governments.

What happened

Virtual servers in four zones of East Japan Region 1 stopped and could not be restarted. The company attributes the incident to unauthorized access by a third party and says the detailed cause and full scope are still under investigation.

IDC Frontier said it expects data stored in the affected zones to be difficult to retrieve or restore, and that recovery is currently possible only from backups customers maintain themselves. It is advising affected customers to rebuild in a separate environment and restore from their own backups.

Response

• East Japan Region 1 was cut off from the network and its systems shut down on October 7
• An external security firm is helping identify and close the intrusion route across the East and West Japan regions
• Customer consoles are suspended, and IDCF is performing start and stop operations on request
• The company has reported the incident to the supervising government ministry and the Metropolitan Police Department

Scope

Customers in other zones of the region, East Japan Regions 2 and 3, and West Japan Region 1 were told to back up their own data as a precaution; no unauthorized access has been confirmed there so far. IDCF Cloud Type S and IDCF Private Cloud were not affected.

The company said it is reviewing measures to prevent a recurrence.