JR Kyushu

Summary

JR East reported that data in email-delivery services affected by the 7 October 2026 IDCF Cloud ransomware incident may have been compromised, in a disclosure covering about 6.09 million mostly email accounts jointly cited with View Card. No group was named.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On 7 October 2026, at approximately 03:40 JST, IDC Frontier confirmed that a third party had used ransomware against IDCF Cloud, the infrastructure-as-a-service platform operated by the SoftBank Corp. subsidiary. The disruption was concentrated in four zones of IDCF Cloud’s East Japan Region 1: tesla, henry, pascal and joule. The remaining zones in East Japan Region 1, IDCF Cloud’s other regions, IDCF Cloud TypeS and IDCF Private Cloud were not affected at the service level. IDC Frontier disabled management-console access across all regions while it conducted safety checks. This was a provider incident rather than the exploitation of a named software vulnerability, and no affected product version or CVE was identified.

On 8 October, IDC Frontier said that data held in the four affected zones was unlikely to be recoverable. As customers disclosed the downstream effects of the outage, JR Kyushu reported on 9 October that approximately 1.3 million accounts associated with its email-delivery services may have been compromised. JR Kyushu issued this warning alongside disclosures from JR East and View Card, which together reported about 6.09 million potentially affected accounts. The JR Kyushu disclosure stated that the records in the affected email-delivery services may have been exposed; it did not confirm that all or any particular subset of the 1.3 million accounts had been accessed. The warning came before IDC Frontier published the results of its investigation into whether data had been removed from customer virtual servers.

On 14 October, IDC Frontier said it had found no trace of data in customer virtual servers being viewed or taken out and concluded that no data had leaked externally. In a separate finding, IDC Frontier said attackers had improperly viewed registration records for 48 customer companies in the IDCF Cloud Portal. Those records included login IDs, hashed passwords and notification email addresses, but IDC Frontier also found no evidence that this portal data had been taken out. The provider did not publicly reconcile its conclusion that no customer virtual-machine data had leaked with JR Kyushu’s earlier warning that approximately 1.3 million accounts may have been compromised. No subsequent statement in the available incident record established whether JR Kyushu had received a portal-record notice, whether its affected email-delivery service was among the customer systems covered by the virtual-server findings, or whether any JR Kyushu account data had been confirmed as accessed.

The recovery position reported by IDC Frontier on 14 October was that its backups had been verified as safe. Of the 495 affected customers and local governments, 194 had used the provider’s snapshot feature and could retrieve backup data. The remaining affected customers were required to restore from their own backups. The incident record does not specify which recovery route JR Kyushu’s affected service required or whether JR Kyushu was among the snapshot customers. The broader operational consequences included Nissui Logistics suspending shipments at all sites before partially resuming on 9 October, while the FutureShop e-commerce platform and the Ibaraki Prefecture and prefectural police websites were also reported affected. These incidents were knock-on effects of the IDCF Cloud disruption, although the wider wave of Japanese disclosures was not linked to IDCF Cloud unless specifically stated.

Customers who took screenshots before losing console access supplied an unverified account of the attackers’ claimed actions. Those messages claimed that the entire breach took seven minutes, that 225 databases containing 3.6 petabytes had been encrypted, and that 554,153 snapshots had been wiped. No ransomware group was identified, and those claims had not been verified. IDC Frontier did not disclose the intrusion path, citing security reasons, and had not published indicators of compromise or linked any external threat intelligence to this attack. As of 17 October, the provider’s confirmed findings remained the unauthorized encryption-driven disruption in four East Japan Region 1 zones, the absence of evidence that data was removed from customer virtual servers, and the limited exposure of registration records viewed within the IDCF Cloud Portal. JR Kyushu’s 1.3 million-account warning remained the principal disclosed downstream impact involving the company, with the provider’s broader no-leakage conclusion and the customer’s warning still publicly unreconciled.

Sources

Sources available to members: 1 source.