Intruders breach SoftBank unit IDC Frontier's cloud portal authentication and encrypt servers, knocking out VMs for 495 companies and local governments

Japanese cloud provider IDC Frontier said on October 7 that an outage in its IDCF Cloud East Japan Region 1 starting at about 3:40 a.m. that day was caused by a third-party ransomware attack affecting 495 contracted companies and local governments ^[1][3]. Its October 27 findings say the attacker exploited a vulnerability in open-source software used by the IDCF Cloud Portal authentication system, then gained admin rights on the virtualization platform and stopped and encrypted customer VMs; the company says data inside customer VMs was not exfiltrated, but registration data for up to 71 customers in the portal was improperly queried ^[2]. Affected customers should follow the company's individual notices to migrate to alternative environments or retrieve backup data, and note that management consoles and the portal stay suspended until verified safe ^[1][2].

Industries mainly affected: Government, Technology

1. Affected customers should follow IDC Frontier's individual notices and support to migrate to alternative environments or retrieve available backup data .