Ibaraki Prefecture

Summary

The Ibaraki Prefecture website was reported offline among prefectural sites affected following the 7 October 2026 IDCF Cloud ransomware attack. The source provides no further detail on data loss and names no threat actor.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On 6 October 2026 at 21:40 Israel Daylight Time, equivalent to approximately 03:40 JST on 7 October, a third party launched a ransomware attack against part of IDCF Cloud, the infrastructure-as-a-service platform operated by IDC Frontier, a SoftBank Corp. subsidiary. The affected service areas were the tesla, henry, pascal and joule zones of East Japan Region 1. At the service level, the radian and newton zones in East Japan Region 1, East Japan Regions 2 and 3, and West Japan Region 1 were not affected, while IDCF Cloud TypeS and IDCF Private Cloud were outside the scope of the incident. IDC Frontier disabled management-console access across all regions while it examined the platform and its unaffected areas. The provider subsequently reported that 495 companies and local governments had been affected.

Among the downstream service disruptions reported during the following days, the Ibaraki Prefecture website and the prefectural police websites were affected. The available account did not specify the duration of the Ibaraki outages, the underlying technical cause of those individual website failures, or whether any Ibaraki data was accessed. No data loss or exposure specific to the Ibaraki websites was reported. FutureShop’s e-commerce platform was also reported as affected, demonstrating that the disruption reached externally facing customer services beyond the IDCF platform itself. The Ibaraki and prefectural police website outages formed part of the wider operational consequences attributed to the IDCF Cloud incident.

Other customers reported consequences in communications, logistics and retail. JR East and View Card said roughly 6.09 million accounts, consisting mainly of email addresses, might have been compromised through affected email-delivery services, while JR Kyushu issued a similar warning concerning approximately 1.3 million accounts. These customer warnings were issued on 9 October, before IDC Frontier’s later finding that data in customer virtual servers had not been found to have been viewed or removed; the two public positions had not been reconciled. Nissui Logistics stopped shipping at all sites and partially resumed operations on 9 October. It said no group personal information or customer data was present on the affected servers, and it began building a replacement system on separate servers, with normal operations expected across all sites during the week of 19 October.

Before customers were locked out of the management console, some captured screenshots of a message displayed by the attacker. The unverified message claimed that the breach had taken seven minutes, 225 databases containing 3.6 petabytes had been encrypted, and 554,153 snapshots had been wiped. No ransomware group was identified, and IDC Frontier did not publish indicators of compromise associated with the incident. The provider told Nikkei xTECH that it had identified the intrusion path but would not disclose it for security reasons. No vulnerability, CVE or affected product version was named.

On 8 October, IDC Frontier said data in the four affected zones was unlikely to be recoverable. By 14 October, it had verified that backups were safe and stated that 194 of the 495 affected customers, all of whom had used the platform’s snapshot feature, could retrieve snapshot data. For affected customers without available snapshots, the stated recovery path was restoration from their own independent backups. IDC Frontier made individual contact with customers regarding snapshot retrieval and the incident. It also continued safety checks in regions and zones that had not experienced a service-level impact.

In its 14 October update, IDC Frontier said it had found no trace of data in customer virtual servers being viewed or taken out and assessed that no data had leaked externally. Separately, it confirmed that attackers had improperly viewed registration records belonging to 48 customer companies in the IDCF Cloud Portal. Those records included login IDs, hashed passwords and notification email addresses, and the provider found no evidence that the registration data had been removed. The public account did not identify Ibaraki Prefecture as one of the 48 affected portal customers or report a specific access event involving its website data. The provider-wide virtual-server finding likewise did not establish any Ibaraki-specific exposure.

The IDCF attack occurred during a broader series of security disclosures involving Japanese organizations. During the same week, skyticket reported up to 14.64 million affected records, Yakiniku King reported 10.79 million, Daiichikosho reported a possible 8.72 million, Bookoff reported 6.43 million, Lawson reported about 2.15 million and Mr Max reported 1.74 million. The figures represented maximum or possible record counts, overlapped with one another and did not necessarily correspond to distinct individuals. JPCERT/CC issued warnings about attacks abusing internal APIs discovered through smartphone applications and about web shells installed on Java application servers. The National Cybersecurity Office, IPA, METI, MIC and the FSA also issued warnings, while the wider incidents and JPCERT/CC’s published attacker addresses were not linked to IDCF Cloud.

By the 17 October report, the confirmed sequence was a third-party ransomware attack beginning on 7 October, service-level disruption in four IDCF Cloud East Japan Region 1 zones, and reported outages of the Ibaraki Prefecture and prefectural police websites. IDC Frontier had found no evidence of virtual-server data exfiltration, had identified improper viewing of portal records for 48 customers, had verified that its backups were safe, and had opened snapshot retrieval for 194 affected customers.

Sources

Sources available to members: 1 source.