IDC Frontier: ransomware attack on IDCF Cloud

Ransomware disrupted IDCF Cloud East Japan Region 1 on October 7, affecting 495 corporate and municipal customers. IDC Frontier's October 14 fifth report found no traces of virtual-server data queries or exfiltration and concluded that this data had not leaked. Snapshots for 194 customers were recoverable. Separately, portal registration information of 48 companies was queried without authorization, including one email address at each of two companies that may contain a contact person's name; login IDs and difficult-to-reverse password hashes were also queried, without evidence of external transfer. The initial JR East group concerns were separately reported as about 1.67 million Eki-net, 390,000 Otona no Kyujitsu Club and 4.03 million View Card records, not confirmed leakage; the companies announced their no-leak conclusions on October 15. On October 18 it announced resumption of the backup service after safety verification; the snapshot feature remained suspended. JR Central said on October 13 that the contractor sending mail for its JR Central MARKET and Iimono Tanbo online shops used IDCF Cloud, so about 15,000 records such as email addresses and order details might have leaked; on October 15 the contractor reported no leak. The websites of Ibaraki Prefecture and its police were restored from a 5 October backup on 26 October, after 19 days. Its seventh report on 27 October said the cause was a vulnerability in open source software used by the IDCF Cloud Portal's authentication system. Through the management console the attacker gained administrator rights on the virtualization platform, then stopped and encrypted virtual machines. No removal of data inside the virtual machines has been found. Registration details of up to 71 companies, including up to 31 personal names and email addresses, were viewed without authorization, and up to 4 login passwords were changed. Backups of 206 customers can be restored. The investigation is complete; the portal stays stopped and will reopen in three stages with a new external identity provider. There was no ransom demand or payment. Soliton Systems' Soliton SecureDesktop has also been down since the 7th. On 19 October Daihatsu Motor also said some features of Daihatsu Port and Daihatsu Connect, such as new member sign-up, had stopped.