On 7 October 2026 at about 3:40 a.m. Japan time, Japanese cloud provider IDC Frontier, a SoftBank subsidiary, was hit by ransomware in its East Japan Region 1. According to the company, 495 companies and local governments are affected and, in four zones, customer data is considered difficult to recover. Here is what we know, what the attackers claim without proof and what this incident reminds us about backups at a cloud provider.
What happened
IDC Frontier first announced unauthorized access, then called it a ransomware attack in its second report the same day. The company cut the East Japan Region 1 network and shut down its systems to limit the damage, then paused its externally reachable management console, according to @IT. It is working with external security firms and has reported the incident to the supervising ministry and Tokyo police, according to Japan Cyber Watch.
The entry route, the attackers’ identity and any ransom demand are not known to date.
Four zones hit, data hard to restore
The third report, on 8 October, named four zones in East Japan Region 1: tesla, henry, pascal and joule. IDC Frontier considers customer data there difficult to extract or restore, except from backups held by customers themselves. The radian and newton zones, East Regions 2 and 3 and West Region 1 showed no confirmed unauthorized access. IDCF Cloud TypeS and IDCF Private Cloud are not affected, according to Japan Cyber Watch.
On 14 October, in the fifth report, snapshots turned out to be intact and can be retrieved for 194 of the 495 customers, those who had enabled the feature. The other 301 depend on their own backups, and whether restoration is possible is being discussed case by case. On 18 October, IDCF Cloud backup resumed for unaffected zones and regions, but the snapshot function remains suspended.
Was data stolen? An answer based on the absence of traces
IDC Frontier says it found no trace showing that data in customers’ virtual servers was viewed or taken, and concludes there was no leak. This conclusion rests on the absence of traces, and how far back the logs go is not stated. Separately, account details for 48 customers on the IDCF Cloud portal (login IDs, password hashes and contact email addresses) were improperly viewed.
On social media, an image mimicking the IDCF Cloud console, with the message “YOUR CLOUD IS OURS”, claims 239 hypervisors reached, 225 datastores encrypted, over 16,600 virtual machine disks and 554,153 snapshots. IDC Frontier has not confirmed these figures, says the image appears to match what its console showed, and no ransomware group is named, according to @IT. Other outlets report 225 “databases” totaling 3.6 PB, as reported by SC Media: the wording differs by source and remains an attacker claim.
The impact on customers
Several big Japanese names are among the affected customers, according to the notices relayed by Japan Cyber Watch:
- JR East and View Card: data from an email delivery service, up to about 6.09 million records. They cannot rule out that it was viewed or taken. Their notices had not been updated as of the evening of 15 October.
- JR Kyushu (about 1.3 million) and JR Central (about 15,000): no leak confirmed as of 15 October, based on IDC Frontier’s investigation.
- Peach Aviation: about 1.89 million records in the affected system, no leak confirmed.
- Nissui Logistics: shipping and receiving disrupted, with normal operations expected the following week according to its 14 October notice. A direct link to IDCF is not established in the sources we read.
- Prefectures and municipalities: several local government sites went down on 7 October. No official source linked all these outages to the attack; Ibaraki Prefecture first cited a power failure.
Lessons for your backups
- Keep at least one copy outside your provider’s infrastructure, and test restores regularly. Here, customers without an external copy had only snapshots hosted in the same place to fall back on, found intact for just 194 of them.
- Don’t confuse a snapshot with a backup: a snapshot hosted at the same provider shares its fate if the infrastructure is compromised.
- Change your cloud portal password, and any you reuse elsewhere, if you are among the accounts viewed.
- Beware of phishing impersonating JR East, View Card, JR Kyushu, JR Central, Peach or Takashimaya: use official sites or apps rather than links received by email.
And if you are not an IDC Frontier customer?
The core lesson applies to any hosting: a cloud provider can suffer an attack that destroys both your data and the copies it keeps for you. If your critical data exists with only one host, ask yourself where your last independent copy is and whether you know how to restore it.
Sources: Japan Cyber Watch, @IT, Impress Watch and SC Media.
Frequently asked questions about the IDCF Cloud ransomware attack
It is the cloud service of IDC Frontier, a SoftBank Group subsidiary, which hosts virtual servers for companies and local governments in Japan.
495 companies and local governments according to IDC Frontier. Snapshots are retrievable for 194 of them; the other 301 depend on their own backups.
IDC Frontier found no trace of data theft in the virtual servers, but that conclusion rests on the absence of traces. Account details for 48 customers on the portal were viewed.
Unknown. An image shared on social media claims it, but no group is identified and its figures are not confirmed.
Keep a tested backup outside your provider’s infrastructure, because a snapshot at the same host is not an independent backup.
Leave a Reply