Breaches and incidents
IDC Frontier (SoftBank group cloud): ransomware via portal auth vulnerability encrypts VMs of 495 companies and municipalities
IDC Frontier said a ransomware attack from about 3:40 am on 7 Oct stopped and encrypted virtual servers in part of IDCF Cloud East Japan Region 1...
- Disclosed
- Verification
- Checked against a primary source
What happened
- IDC Frontier said a ransomware attack from about 3:40 am on 7 Oct stopped and encrypted virtual servers in part of IDCF Cloud East Japan Region 1, affecting 495 companies and local governments; its 27 Oct final report found no exfiltration of data inside customer VMs.
- Root cause per the company: a vulnerability in open-source software used by the IDCF Cloud Portal authentication system let the attacker in, then they used the management console to obtain virtualization-platform admin rights and encrypt VMs.
- No attacker named.
- The network was cut and systems stopped; restoration in the old environment is unlikely, backups were recoverable for 206 customers, the portal stays offline, and the company plans an external IdP, SBOM-based vulnerability matching and expanded patching.