Ransomware in one IDCF Cloud region hits 495 companies and local governments

IDC Frontier has confirmed the ransomware and the customer count ^[1][4]. "Our investigation has determined that a disruption in East Japan Region 1 was caused by a ransomware attack by a third party," the company said in its announcement ^[3]. "We are continuing to investigate the precise cause and the scope of the impact," it added ^[19].

The company did not publish figures for encrypted data, hypervisors or snapshots. Those numbers come from the attacker's own message, which customers captured in screenshots ^[10][11]. They are the attacker's claims until IDC Frontier confirms or disputes them.

IDCF Cloud rents out virtual servers, storage and networking, and customers use them to run websites, applications and business systems in Japanese data centers ^[6]. The attacker says it reached 239 hypervisors ^[11]. If that is accurate, the intruder was working at the layer that runs those virtual servers. One breach there was enough to disrupt 495 companies and local governments ^[4].

For tenants, the snapshot claim matters most because it decides how they recover. Set 554,153 wiped snapshots against 16,000 sealed disks and the attacker is claiming about 35 recovery points destroyed for every disk it locked ^[20].

BleepingComputer reports that it is unclear whether the Nissui Logistics outage is connected to the IDCF attack ^[14]. Nissui, a seafood and food group with about 11,500 employees, is investigating whether personal information or customer data leaked ^[13].

The wider count from Macnica covers a different kind of incident: personal-data theft or exposed data ^[15]. The security firm logged 119 such incidents since the start of the year, 83 of them between July 1 and October 6 ^[15]. That leaves 36 for the first six months ^[21]. Under the same criteria it counted 84 in all of 2025 and 62 in 2024 ^[16].

In those incidents, attackers probed websites and APIs for access-control, configuration and authentication weaknesses and exploited known vulnerabilities, according to Macnica's analysis ^[17]. Macnica researcher Yutaka Sejiyama told BleepingComputer that finding weaknesses specific to individual websites has traditionally taken considerable time and effort. That effort made small targets less attractive, he said ^[18]. BleepingComputer suggests that cheap, capable AI tools may be why that is changing ^[22].