Bare Metal Cyber Weekly Roll-Up — October 9, 2026

First, a Japan cloud ransomware outage disrupts 495 organizations.

A ransomware attack disrupted cloud services used by 495 companies and local governments in Japan.

The operator isolated and shut down systems in an eastern Japan data center cluster after the attack began.

Management consoles across all regions were also disabled, while security checks continued.

The intrusion route and full operational impact remain under investigation.

This means the outage can prevent customers from managing virtual servers, storage, networks, websites, applications, and business systems.

For leaders, shared cloud infrastructure can concentrate operational risk across hundreds of organizations at once.

For defenders, validate independent backups, recovery access, and continuity procedures that do not depend on the affected management console.

Watch for failed console access in administrative logs and backup job failures in recovery systems.

claims that databases, virtual machine disks, and snapshots were damaged remain unverified.

The larger lesson is that cloud resilience must account for provider-wide control restrictions, not only individual workload failure.

The recommendation is to inventory affected dependencies, activate continuity plans, and verify recoverable backups outside the impacted environment.

Next, stolen FortiGate access locks out administrators and fuels ransomware.

Organizations are losing administrative control of exposed FortiGate firewalls and VPN gateways.

Attackers are using stolen or leaked credentials, cracking harvested password hashes, and creating new administrator accounts.

Some attackers delete existing accounts or change their passwords to lock out legitimate teams.

More than 86,000 devices across 194 countries were estimated to be compromised.

The access has also been linked to ransomware affiliates.

This means valid credentials let attackers bypass defenses that focus only on software weaknesses.

For leaders, an overlooked identity failure at the network edge can become operational disruption and a ransomware incident.

For defenders, recover control of affected appliances, terminate active sessions, reset credentials, and check connected networks for lateral movement.

Watch for new administrator accounts and password changes in appliance audit logs, plus unfamiliar sessions and authentication records.

Patching alone is insufficient when persistent accounts and stolen credentials remain usable.

The larger lesson is that edge device identities require the same protection and monitoring as other privileged enterprise accounts.

The recommendation is to restrict external access, reset privileged credentials, enforce phishing-resistant authentication, and investigate every unauthorized administrative change.

First, a Japan cloud ransomware outage disrupts 495 organizations.

A ransomware attack disrupted cloud services used by 495 companies and local governments in Japan.

The operator isolated and shut down systems in an eastern Japan data center cluster after the attack began.

Management consoles across all regions were also disabled, while security checks continued.

The intrusion route and full operational impact remain under investigation.

This means the outage can prevent customers from managing virtual servers, storage, networks, websites, applications, and business systems.

For leaders, shared cloud infrastructure can concentrate operational risk across hundreds of organizations at once.

For defenders, validate independent backups, recovery access, and continuity procedures that do not depend on the affected management console.

Watch for failed console access in administrative logs and backup job failures in recovery systems.

claims that databases, virtual machine disks, and snapshots were damaged remain unverified.

The larger lesson is that cloud resilience must account for provider-wide control restrictions, not only individual workload failure.

The recommendation is to inventory affected dependencies, activate continuity plans, and verify recoverable backups outside the impacted environment.

Next, stolen FortiGate access locks out administrators and fuels ransomware.

Organizations are losing administrative control of exposed FortiGate firewalls and VPN gateways.

Attackers are using stolen or leaked credentials, cracking harvested password hashes, and creating new administrator accounts.

Some attackers delete existing accounts or change their passwords to lock out legitimate teams.

More than 86,000 devices across 194 countries were estimated to be compromised.

The access has also been linked to ransomware affiliates.

This means valid credentials let attackers bypass defenses that focus only on software weaknesses.

For leaders, an overlooked identity failure at the network edge can become operational disruption and a ransomware incident.

For defenders, recover control of affected appliances, terminate active sessions, reset credentials, and check connected networks for lateral movement.

Watch for new administrator accounts and password changes in appliance audit logs, plus unfamiliar sessions and authentication records.

Patching alone is insufficient when persistent accounts and stolen credentials remain usable.

The larger lesson is that edge device identities require the same protection and monitoring as other privileged enterprise accounts.

The recommendation is to restrict external access, reset privileged credentials, enforce phishing-resistant authentication, and investigate every unauthorized administrative change.