SoftBank expanded the scope of its group security checks to include open-source software, following a breach of its subsidiary IDC Frontier’s cloud service. [Photo: SoftBank]
Japan’s SoftBank will strengthen security inspections across its group after its subsidiary IDC Frontier suffered ransomware damage. It judged that advances in AI have accelerated cyberattacks and vulnerability discovery, exposing limits in existing manpower-based response systems.
ITmedia reported on Nov. 10 that SoftBank President Junichi Miyakawa apologised at an earnings briefing a day earlier for the IDC Frontier hacking incident and said the company would comprehensively review its security response system.
IDC Frontier said its IDCF Cloud service was attacked on Oct. 7 through a vulnerability in open-source software used in its authentication system. Some virtual servers were halted and encrypted, causing damage to 495 customers including companies and local governments.
SoftBank acknowledged it had checked vulnerabilities and applied security patches for its in-house applications, but the open-source software exploited in the attack was excluded from inspections. It has expanded urgent inspections beyond about 1,800 systems to cover open-source software across the group.
Reconnaissance activity that precedes cyberattacks has also surged. SoftBank observed monthly average reconnaissance acts rising to 600 million to 700 million recently from about 300 million last year, more than doubling.
Miyakawa said he suspected the development of open AI models such as Kimi from China’s Moonshot AI and Qwen from Alibaba could be related to the increase in attacks. He added there is no proven causal relationship that any specific AI model actually triggered an increase in attacks.
New challenges also emerged in SoftBank’s in-house security checks using AI. SoftBank inspected about 700 systems in June, found about 10,500 vulnerabilities and applied patches over three months.
But a re-assessment using OpenAI’s GPT-6 Astra detected about 35,000 vulnerabilities. Miyakawa said, “Additional problems are found every time we inspect with a new AI model, increasing the burden of 대응.”
SoftBank changed its response procedures from the previous approach of having staff investigate and hold meetings when anomalies are detected to a method that first blocks communications.
It has automated vulnerability diagnosis and patch application. It also plans to automate within this fiscal year the work of checking whether systems operate normally after patches.
Click Here For The Original Source
——————————————————–
