In October 2026, a ransomware attack on a major domestic cloud infrastructure affected 495 companies and local governments, and furthermore, a leak of approximately 2.15 million personal information records was uncovered at Lawson. In the background are a lack of awareness regarding the cloud’s shared responsibility model and an increase in unauthorized access exploiting vulnerabilities in system configurations.

Key Points of the Incident and Overall Scale of Damage

In October 2026, a series of major cyber incidents shaking Japan’s IT infrastructure came to light. A ransomware attack by a third party occurred on “IDCF Cloud,” an enterprise cloud service operated by SoftBank subsidiary IDC Frontier, causing severe disruptions to the systems of as many as 495 companies and local governments. The outage occurred around 3:40 a.m. on October 7, 2026, at “East Japan Region 1” located in Shirakawa City, Fukushima Prefecture, prompting the company to suspend its management console to prevent further damage.

Meanwhile, the following day on October 8, major convenience store chain Lawson announced that unauthorized access to its internal systems had resulted in the leakage of 2,155,345 pieces of personal information. The affected data includes names, addresses, phone numbers, and email addresses—representing approximately 10% of Lawson ID members—along with partial credit card numbers for 26 cases via the app’s reservation feature. This simultaneous blow to both infrastructure platforms and major retail corporations highlights the vulnerabilities within Japan’s digital society. Please refer to the figure below.

IDC Frontier Outage and Its Impact on Society and Logistics

The outage at IDCF Cloud went beyond a mere IT service stoppage, exerting a wide-ranging adverse impact on people’s daily lives and the real economy. At major food company Nissui, the system failure of an outsourced logistics service provider caused the shipping and receiving of frozen foods to halt at locations nationwide, with the impact spreading to approximately 1,200 retail and restaurant businesses. Furthermore, among local governments, the official websites of Ibaraki Prefecture and Kodaira City in Tokyo became inaccessible, while various web services—including the Japan Basketball Association and JRA-VAN World—successively suffered from service outages.

Even more serious is the confusion regarding the prospects for data recovery. It has been revealed that IDC Frontier notified some corporate users that “data recovery is difficult.” In response, the developer of the speech recognition app “UD Talk” has shifted to a policy of independently rebuilding its environment on a separate cloud infrastructure. Meanwhile, some businesses, such as the commission service SKIMA, are proceeding with recovery efforts from surviving data, resulting in a stark contrast in each company’s path to recovery depending on differences in their backup systems.

Cyber Attack Methods and Structural Issues Revealed Through Case Analysis

Direct Intrusion Threats Seen in the Lawson Unauthorized Access Incident

The personal information breach incident at Lawson symbolizes recent shifts in intrusion patterns seen in cyberattacks. In recent major data breaches, the “outsourced-vendor-mediated type” had been prominent—where an external contractor’s PC is infected with malware, causing damage, much like the case with Daiichikosho. However, Lawson’s case has been found to be a “direct intrusion type,” in which a third party directly launched unauthorized access against authentication servers and app reservation systems.

Technically, it is suspected that flaws in the external access control of the app reservation system and attack methods targeting the Lawson ID authentication server were employed. Furthermore, although the actual unauthorized access took place from September 12 to 17, 2026, its discovery was delayed by approximately three weeks until the periodic inspection on October 7. It has been pointed out as a major issue that real-time anomaly detection and log monitoring failed to function sufficiently in a multi-layered system where multiple web services and ID infrastructures are intricately linked. Please refer to the figure below.

Blind Spots and Operational Risks of the Cloud Shared Responsibility Model

This series of incidents has once again highlighted a lack of understanding regarding the “shared responsibility model” in cloud computing and gaps in operational practices. According to definitions by major cloud providers, the provider’s responsibility is limited to the “security of the cloud” itself, such as physical data centers and virtualization hypervisors. On the other hand, the “security in the cloud”—including data management running on top of it, access control settings (IAM), OS and application patching, and communication encryption—entirely falls within the responsibility of the user company.

In many companies, based on the misconception that “adopting the cloud means you’re secure,” issues such as misconfigured public storage settings, neglected excessive access permissions, and inadequate monitoring rules are occurring. Particularly in IaaS environments, the layers that users must manage are extremely broad, and configuration oversights become prime targets for attackers. It is essential to accurately understand your own area of responsibility and establish systems for regular privilege audits, encryption operations, and inspections by external specialized organizations.

Management Risks Faced by Companies and the Required Direction for Defense

Massive Economic Losses and the Reality of Business Continuity

Damage from cyberattacks is no longer merely a system failure; it has become a fatal management risk that directly threatens a company’s financial foundation and survival. According to a survey conducted in December 2025 by the security evaluation platform Assured, 10.0% of large enterprises that experienced an incident suffered massive economic losses of 1 billion yen or more. Furthermore, 14.2% of companies experienced business suspensions or severe disruptions lasting for an extended period of one month or more.

The breakdown of losses includes system investigation and recovery costs, as well as damages, lost opportunities, and decreased sales due to reputational damage. From a legal perspective, administrative penalties are becoming increasingly severe; for instance, revisions to the Act on the Protection of Personal Information have raised corporate fines for violating orders to up to 100 million yen. Furthermore, 58.2% of companies have experienced incidents caused by business partners, making it essential to evaluate and manage the security status not only of the company itself, but of the entire supply chain as a management issue.

Assume-Breach Security and the Data-Less Strategy

In future cyber defense, it is essential to shift the security paradigm based on the premise that “it is impossible to prevent attacks 100%.” There is an urgent need to transition from traditional methods that rely on network perimeter defenses to a “Zero Trust” architecture that verifies all access, and to build an initial response system that immediately limits and isolates the scope of damage even in the event of a breach.

Another notable new approach is the “strategy of not retaining excessive personal information.” For companies to continue holding large amounts of customer data over long periods can become a massive future liability. By utilizing infrastructure such as the digital authentication services utilizing My Number cards promoted by the Digital Agency, reliable identity verification becomes possible in real time without companies needing to hold personal information on their end. Alongside the strengthening of security technologies, a design philosophy that minimizes the data held itself will hold the key to corporate defense moving forward.

Reference Page

• [Notice (Lawson, Inc.)] https://www.lawson.co.jp/contents/cont07/1533174_3310.html
• [Threats and Countermeasures of “Ransomware” Malware (Tokyo Metropolitan Police Department)] https://www.keishicho.metro.tokyo.lg.jp/kurashi/cyber/joho/ransomware_threat.html
• [Shared Responsibility Model (Amazon Web Services)] https://aws.amazon.com/jp/compliance/shared-responsibility-model/

【#Cybersecurity #CloudOutage #DataLeak #Ransomware #SharedResponsibilityModel #ZeroTrust #Lawson #IDCFrontier】