Nissui Logistics

Summary

After the 7 October 2026 ransomware attack on IDCF Cloud, Nissui Logistics stopped shipping at all sites and partly resumed on 9 October. It said no group personal or customer data was present on the affected servers, and no attacker was named.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On 7 October 2026, at approximately 03:40 JST, equivalent to 21:40 IDT on 6 October, a third party used ransomware to disrupt part of IDCF Cloud, the infrastructure-as-a-service platform operated by IDC Frontier, a SoftBank Corp. subsidiary. The disruption affected the tesla, henry, pascal and joule zones in East Japan Region 1. IDC Frontier reported that 495 companies and local governments were affected. The radian and newton zones in East Japan Region 1, East Japan Regions 2 and 3, and West Japan Region 1 were not affected at the service level, although safety checks continued. IDCF Cloud TypeS and IDCF Private Cloud were outside the scope of the incident. IDC Frontier also disabled management-console access across all regions while it examined the platform.

Nissui Logistics, the logistics subsidiary of seafood group Nissui, was one of the organizations affected through its use of the cloud service. The company stopped shipping at all of its sites. Nissui reported that no group personal information or customer data was present on the servers affected by the incident. On 9 October, the company partially resumed shipping. It began building a new system on separate servers and expected operations to return to normal at all sites during the week of 19 October.

On 8 October, IDC Frontier said that data held in the four affected zones was unlikely to be recoverable. The loss of access to those systems continued to produce operational effects across IDCF Cloud customers. In addition to Nissui Logistics, the reported downstream effects included disruption to the FutureShop e-commerce platform and offline prefectural and prefectural police websites. These events occurred as the provider and its customers assessed the scope of the ransomware attack and the availability of recovery sources.

Customer disclosures also raised questions about data held in services hosted in the affected environment. On 9 October, JR East and View Card warned that approximately 6.09 million accounts, primarily email addresses, held in an email-delivery service may have been compromised. JR Kyushu issued a similar warning concerning approximately 1.3 million accounts. Those statements were made before IDC Frontier reported that it had found no evidence of customer virtual-machine data being viewed or removed. The two positions had not been publicly reconciled in the source material.

On 14 October, IDC Frontier stated that it had found no trace of data in customer virtual servers being viewed or taken out and concluded that no data had leaked externally from those virtual machines. The provider separately determined that attackers had improperly viewed registration records belonging to 48 IDCF Cloud customers in the IDCF Cloud Portal. Those records included login IDs, hashed passwords and notification email addresses. IDC Frontier found no evidence that the registration data had been taken out. The incident therefore involved confirmed unauthorized viewing of portal records and a service-level ransomware disruption, while the provider’s investigation found no evidence of data exfiltration from customer virtual servers.

IDC Frontier also reported that its backups had been verified as safe. Of the 495 affected customers, 194 had used the platform’s snapshot function and could retrieve their backup data. The remaining customers were required to restore from their own backups. The provider continued its safety checks in unaffected regions and zones, and management-console access had initially been disabled in every region as part of those checks. No affected software versions or product vulnerability were identified because the event was a provider incident rather than an exploitation of a named product or CVE.

IDC Frontier told Nikkei xTECH that it had identified the route by which the attacker entered the environment, but it did not disclose the intrusion path for security reasons. The provider had not published indicators of compromise associated with the IDCF Cloud attack. Attackers’ claims were limited to unverified messages shown in customer screenshots taken before console lockout. Those messages claimed that the breach took seven minutes, that 225 databases totaling 3.6 petabytes were encrypted and that 554,153 snapshots were wiped. No ransomware group had been identified, and the source material noted that these attacker claims had not been verified.

Nissui Logistics continued its recovery by replacing the affected operating environment with a system on separate servers. Its shipping operations had partially resumed by 9 October, with full normalization expected during the week of 19 October. Nissui’s reported consequence was therefore a complete interruption of shipping across its sites followed by a staged operational restart, while the company maintained that no group personal or customer data had been present on the affected servers.

Sources

Sources available to members: 1 source.