Concentric is monitoring the escalating Houthi campaign against Saudi Arabia, after a strike on Riyadh’s main airport killed at least 12 people and halted flights. We are also tracking youth-led protests in India over the revision of voter rolls, after authorities detained thousands of demonstrators and restricted mobile internet in New Delhi, with further disruption likely in major cities. Finally, we are assessing a ransomware attack on a SoftBank cloud subsidiary that cut off nearly 500 companies and local governments in Japan, exposing the potential vulnerabilities organizations face through shared cloud infrastructure.
Suspected Houthi Strike on Riyadh Airport Kills 12 as Yemen War Spreads Into Saudi Arabia
A strike on Riyadh’s King Khalid International Airport on October 10 killed at least 12 people, including a U.S. citizen, and wounded 309, according to Saudi authorities. It was the third attack on the airport in a week. Earlier strikes claimed by the Houthis killed four people, including a Saudia captain, and damaged a parked Saudia aircraft, while an attack on Abha International Airport killed two. Saudi authorities suspended operations at the airport, and more than 320 flights were canceled on October 10. The Houthis have not claimed the latest strike, but the U.S. State Department blamed the group. The attacks follow an offensive by Yemen’s Saudi-backed government to retake the Red Sea coastline the Houthis seized in September. The Houthis have declared Saudi airspace a military operations zone, warned airlines to avoid it, and threatened to target energy facilities. A projectile also landed near Dammam’s King Fahd International Airport on October 10. Lufthansa, Emirates, Etihad, flydubai, and Air India are among the carriers that suspended Riyadh flights, and the European Union Aviation Safety Agency advised against operating in parts of Saudi airspace. The U.K. government advises against all but essential travel to the Riyadh region, while Germany, Canada, and Australia advise against all travel to Saudi Arabia. President Trump said on October 10 the U.S. “may” join Saudi strikes on the Houthis. Concentric assesses the Houthis have demonstrated the capability and intent to strike civil aviation deep inside Saudi Arabia, and further attacks on Riyadh and other airports are likely while the offensive in Yemen continues. Direct U.S. involvement would likely widen the conflict and raise the threat to Western-linked sites across the Gulf. We advise organizations to defer non-essential travel to Riyadh and southern Saudi Arabia and any participants of the Future Investment Initiative, Saudi Arabia’s flagship investment conference, in Riyadh later this month to review attendance plans. Organizations with personnel in the Kingdom should confirm alternative departure options in case Riyadh flights remain suspended, and advise staff to minimize time at airports and near energy infrastructure.
India Locks Down New Delhi as Youth Protests Over Voter Rolls Escalate
Indian authorities detained thousands of protesters in New Delhi on October 10 to stop a mass demonstration by the youth-led Cockroach movement against Chief Election Commissioner Gyanesh Kumar. Police set up checkpoints on routes into the capital, barricaded the Jantar Mantar protest site, banned gatherings of five or more people in parts of the city, and restricted mobile internet. Officers boarded an aircraft at Delhi airport to detain three of the movement’s leaders arriving from Mumbai, and opposition lawmakers and journalists were also held. The protests target the Election Commission’s revision of voter rolls, which has removed more than 130 million names. The opposition says the revision favors Prime Minister Narendra Modi’s Bharatiya Janata Party, while government and commission officials say it removes duplicate and ineligible entries. Demonstrations began on October 2 after the Indian Express reported Kumar’s deputies disputed the revisions. Thousands marched in Mumbai on October 4, and opposition leader Rahul Gandhi was briefly detained in New Delhi earlier this month. The Cockroach movement formed online in May and forced the education minister’s resignation in July after protests over exam paper leaks, including clashes near Parliament that injured about 180 people. Concentric assesses further protests are likely in New Delhi, Mumbai, and other major cities in the coming weeks, and authorities will likely respond with short-notice gathering bans, road checkpoints, and mobile internet restrictions. We advise organizations with personnel in India to avoid protest sites, including Jantar Mantar and government buildings in central New Delhi, and to allow extra time for travel to airports and offices on announced protest days. Companies should ensure staff have backup communications in case mobile data is restricted.
Ransomware Attack on SoftBank Cloud Unit Cuts Off Nearly 500 Organizations in Japan
A ransomware attack on IDCF Cloud, the cloud platform run by SoftBank subsidiary IDC Frontier, disrupted services for 495 companies and local governments in Japan on October 7. The attack began at 3:40 a.m. local time and forced the company to isolate its East Japan Region 1 data center cluster. IDC Frontier also suspended customer access to management consoles across all regions while it verifies their security. On October 8, the company said customer data in the four affected zones is unlikely to be recoverable and advised customers to rebuild from their own backups. A message left by the attackers claimed they encrypted 3.6 petabytes of data across 225 databases and wiped more than 550,000 snapshots. IDC Frontier has not identified the attackers, and no group has claimed responsibility. Japanese seafood group Nissui separately reported its logistics subsidiary halted shipments after suspected unauthorized access to a third-party data center, though it is unclear whether the incidents are linked. Japanese security firm Macnica has logged 119 incidents involving stolen or exposed data in Japan this year, up from 84 in all of 2025. In a separate advisory on October 6, the Federal Bureau of Investigations and U.S. Secret Service warned the FortiBleed campaign has compromised more than 86,000 Fortinet firewalls and VPN gateways across 194 countries, and ransomware affiliates are using the stolen access to enter corporate networks. Concentric assesses the IDCF Cloud incident shows how a single breach at a cloud provider can disrupt hundreds of downstream customers at once, with recovery depending on backups held outside the affected platform. We advise organizations to identify critical systems that depend on a single cloud provider or region, confirm they hold recent separate backups, and test how quickly they can restore operations. Companies using Fortinet firewalls or VPN gateways should reset administrator and VPN credentials, enforce phishing-resistant multifactor authentication, and review access logs, even if their devices are fully patched.
