On 7 October at approximately 03:40 JST, IDCF Cloud East Japan Region 1 operated by SoftBank subsidiary IDC Frontier experienced a sudden large-scale outage. Customers reported that virtual machines would not boot and console passwords had been reset, yet the operations team continued rebooting servers that were already encrypted.
Attack Timeline
According to reports compiled from Japanese ITmedia NEWS and security sources, the attackers claimed to have completed encryption of the entire region in only seven minutes. The encrypted assets included 239 virtualization hosts, 225 datastores, and at least 16,600 virtual-machine disks, totaling 3.6 PB of primary storage. In addition, 554,153 snapshots were destroyed, resulting in a backup capacity loss of 41.5 PB.
The ransom notes, named RECOVER-INFO.txt, were placed in the root directories of all 225 datastores at around 03:00. Operations personnel did not locate any of these files during the subsequent seven hours. Instead, they repeatedly attempted to restart non-functional virtual machines through VMware vCenter and changed management passwords multiple times.
Customers detected the problem earlier. By 08:34 JST the 75th support ticket had already described virtual machines failing to start. Frustrated by the lack of response, the attackers then defaced the cloud management console homepage with the message “IDCF CLOUD INFRASTRUCTURE SEIZED” and the subtitle “YOUR CLOUD IS OURS”. They also provided explicit instructions for locating the ransom notes via SSH or DCUI on any JE0-cluster ESXi host.
Technical Analysis
The seven-minute encryption window indicates that the attackers had already achieved persistent access, lateral movement, and control over the hypervisors well before the encryption phase. The simultaneous destruction of snapshots and backups removed any remaining leverage for victims. IDCF Cloud later confirmed that data stored in the affected region could not be recovered and advised customers to rebuild from their own independent backups.
The prolonged failure to notice the attack revealed systemic deficiencies: incomplete asset inventories, absent monitoring of critical datastore root directories, and ineffective escalation procedures. No zero-day exploit was required; the incident was a textbook case of incident-response breakdown.
Impact and Recommendations
The outage directly affected 495 customers across the tesla, henry, pascal, and joule availability zones, including enterprises and local government agencies. The provider chose not to pay the ransom and instead issued regular public updates.
Security experts recommend implementing the following immediate measures:
- Move critical backups to offline, immutable, or WORM storage that cannot be reached from production hypervisors.
- Harden VMware vCenter and ESXi hosts by restricting external exposure, enforcing strong authentication, and applying source-based access controls to SSH and DCUI.
- Configure high-priority alerts for anomalous file creation in datastore roots, mass virtual-machine power-offs, and unexpected encryption activity, delivered directly to on-call devices.
- Conduct unannounced ransomware tabletop exercises to ensure teams can recognize and respond to encryption events within minutes rather than hours.
The IDCF Cloud incident demonstrates that cloud-platform security ultimately depends on rapid detection and preservation of offline backups once an attacker has gained a foothold.
