IDC Frontier links ransomware to portal’s open-source flaw

IDC Frontier, SoftBank's cloud subsidiary, released its seventh report on the ransomware attack that took down part of the IDCF Cloud on October 7, affecting 495 businesses and local governments in Japan. According to the document, the entry point was a vulnerability in an open-source software used by the authentication system of the client portal, the IDCF Cloud Portal. The company did not disclose the name of the component or a CVE identifier.

The sequence described by the provider, according to coverage by ITmedia, Business+IT, and Jiji agency, was as follows: the attacker accessed the authentication system, reached the management console, gained administrator privileges on the virtualization platform, and then shut down and encrypted clients' virtual machines. The attack began around 3:40 AM Tokyo time.

What was exposed and what was not

IDC Frontier claims to have found no evidence that data within the clients' virtual servers was copied externally. However, client records in the portal were improperly accessed in up to 71 accounts, compared to 48 in the previous report from October 14. In up to 31 of those accounts, names or email addresses were present. Login passwords were altered by the attacker in up to four cases, and those clients were contacted individually.

The provider stated that it did not pay a ransom or negotiate with the attackers. In the October 14 report, it was stated that snapshot copies could be recovered for 194 of the 495 affected clients, those who had contracted that feature.

Among the announced measures are the creation of an independent unit dedicated to security, the inclusion of open-source software in the scope of vulnerability tests, the adoption of software component inventory (SBOM), and the migration of authentication to an external identity provider.

The chain effect

The scope of the incident extends beyond the list of direct clients. JR East and its card operator View Card reported that about 6.09 million account records, mostly email addresses, may have been exposed in services hosted on the platform. Government websites in Ibaraki province and the provincial police were out of service, according to SoftBank in a report by Kyodo News.

This case adds to that of GMO Internet, which suspended the Onamae.com Desktop Cloud service on October 21 after identifying malicious software on client servers, with up to 26,739 servers potentially affected, according to the company. The sequence led Prime Minister Sanae Takaichi to direct, on October 26, that the cabinet prepare an emergency cybersecurity package within about a week.

Why the portal's flaw matters outside Japan

The technical point of the report is less exotic than the extent of the damage. The attacker did not break the hypervisor. They entered through an open-source authentication library on the self-service portal, a layer that nearly every regional cloud provider builds over public components. The inclusion of open source in the scope of vulnerability tests, listed among the fixes, shows that it was out of that scope until the attack.

There are those who read the episode as an argument against regional providers in favor of the three major American clouds. The argument has limits: AWS, Microsoft, and Google also depend on open components, and Microsoft had a signing key stolen by the Storm-0558 group in 2023, which it used to access client emails. The relevant distinction is another: the size of the team that invents and tests these dependencies, and whether the management console is separate from client authentication.

In the European Union, the NIS2 directive already requires cloud providers to manage software supply chain risks and to send initial alerts to authorities within 24 hours after becoming aware of a significant incident. A case like that of IDCF Cloud would fall under this regime from day one.

In Brazil, Resolution CD/ANPD No. 15, from 2024, gives controllers three business days to report incidents involving personal data. The obligation falls on each client, not on the cloud provider. An attack affecting hundreds of clients, like that of IDCF Cloud, would require hundreds of companies to notify ANPD simultaneously, all relying on information that only the provider has.

The IDC Frontier report took three weeks to name the cause and still does not name the component. For those contracting regional cloud services, the question to ask the provider is no longer whether they have backups. It has become who tests the open source code of the login portal and how often.