SoftBank Admits 7-Minute Cyberattack on IDC Frontier Left Response Behind

How a Seven-Minute Attack Caught SoftBank's Data Centre Arm Off Guard

SoftBank President and CEO Junichi Miyakawa used the group's earnings briefing on 9 November to apologise for a cyberattack on its data centre subsidiary IDC Frontier, calling the incident "deeply regrettable and a source of bitter regret." He disclosed that the attackers completed their intrusion in roughly seven minutes after unauthorised access was first detected — a speed that left the company's response trailing.

According to Miyakawa, the attackers exploited a vulnerability in publicly available open-source software. While SoftBank had run vulnerability checks on its own 700 in-house systems, it had not done the same for open-source components. The breach affected 495 client companies and local governments that contract IDC Frontier's services, though the company says no data was leaked externally.

Miyakawa framed the incident as part of a broader trend: the window between detection and damage is shrinking, and companies are increasingly on the back foot. "It's a contest of endurance, but the only way to prevent it is to keep responding," he said, stressing a policy of prioritising service shutdowns to block unauthorised access. He also revealed that SoftBank's AI-powered vulnerability detection service has now been adopted by more than 7,600 companies.

On the defensive measure of "blocking" — forcibly cutting connections to malicious sites — Miyakawa said it could be a legitimate means of protecting individual rights, but argued it should only be implemented once the government establishes legal standards, given its implications for the secrecy of communications. Separately, SoftBank raised its consolidated net profit forecast for the fiscal year ending March 2027 to ¥610 billion from ¥560 billion, and reported interim revenue of ¥3.7987 trillion, up 11.7% year on year.

Why Open-Source Code Is Now SoftBank's Weakest Link

Why Open-Source Code Is Now SoftBank's Weakest Link

The IDC Frontier breach exposes a structural blind spot that extends well beyond SoftBank. The company checked its own 700 in-house systems for vulnerabilities but did not extend that scrutiny to open-source components — a gap that is common across the industry, where modern cloud stacks are assembled from vast libraries of publicly maintained code. Attackers increasingly target these shared dependencies precisely because a single flaw can unlock many victims at once. For SoftBank, the reputational cost is amplified by the fact that it sells cybersecurity services: its AI-based vulnerability detection tool, now used by over 7,600 companies, is meant to prevent exactly this kind of incident. The breach at a subsidiary therefore raises questions about whether the group's internal practices keep pace with the products it markets.

The Seven-Minute Window and the Case for Blocking

Miyakawa's disclosure that the attack unfolded in about seven minutes is a striking data point on how automation has compressed response times. When detection-to-damage is measured in minutes, manual remediation is effectively impossible; only automated blocking and isolation can keep up. That logic underpins SoftBank's push for legal clarity on "blocking" — forcibly severing connections to malicious sites. Miyakawa's call for government standards reflects a real tension: blocking can protect users, but it also touches the constitutional secrecy of communications. If Japan legislates a framework, telecom operators and cloud providers would gain a clearer mandate to act pre-emptively, but they would also face new compliance obligations and potential liability if blocking is misapplied. For now, the absence of standards leaves companies like SoftBank exposed to criticism whichever way they lean.

What the Financials Say

The breach disclosure came alongside a brighter financial picture. SoftBank lifted its full-year net profit forecast to ¥610 billion and posted interim revenue growth of 11.7%, with operating profit up 2.1% and net profit up 4.5%. The upgrade suggests the core business remains resilient, and the market may treat the cyber incident as a manageable operational risk rather than a financial one — especially since no data leakage was reported. Still, the reputational overhang for IDC Frontier's 495 affected clients could weigh on future contract renewals in the data centre and cloud segment, where trust is a primary currency.

Winners and Losers

Losers include IDC Frontier, which must now rebuild confidence among 495 enterprise and municipal clients, and SoftBank's security sales team, which will face tougher questions about the group's own hygiene. Potential winners are competitors offering managed security and open-source vulnerability scanning, who can point to the incident as evidence that even large operators miss open-source risks. SoftBank's own AI security service could also benefit if the incident drives adoption — a silver lining Miyakawa implicitly highlighted by citing its 7,600-company user base.

What the IDC Frontier Breach Means for Cloud Buyers and Vendors

The seven-minute attack is a warning that open-source dependencies are now the most likely entry point — and that checking only in-house systems is no longer enough.

• For enterprises and municipalities using IDC Frontier or similar cloud providers: ask your vendor directly whether open-source components in their stack are covered by vulnerability scanning, and request written confirmation. The 495 affected clients show that contractual service levels did not prevent impact.
• For security and IT leaders: extend vulnerability management to open-source libraries and third-party dependencies. SoftBank's own admission that it tested 700 in-house systems but not open-source code is a concrete example of the gap to close.
• For vendors selling security services: the incident is a reference case for automated, AI-driven detection and blocking. SoftBank's AI service passing 7,600 adopters indicates demand is already scaling.
• For policy watchers: watch for Japanese government movement on legal standards for "blocking." Miyakawa's call for legislation signals that telecom and cloud operators want a clear framework before applying forced disconnection more broadly.
• For investors: the raised FY2027 net profit forecast of ¥610 billion and 11.7% interim revenue growth suggest the breach has not derailed SoftBank's financial trajectory, but monitor IDC Frontier client retention and any regulatory follow-up for medium-term impact.