What happened to IDCF Cloud in October 2026?

IDC Frontier, a SoftBank subsidiary, said a ransomware attack by a third party began at 03:40 local time on 7 October 2026 and forced it to shut down the network and systems of four zones in IDCF Cloud’s East Japan Region 1. It said 495 companies and local governments using the service were affected. IDC Frontier disabled customer access to management consoles in all regions while it checked their security. On 8 October it said data stored in the four zones was expected to be difficult to retrieve or restore.

Can IDCF Cloud customers get their data back?

IDC Frontier’s third report of 8 October said that, in its current assessment, data in the four affected zones can be restored only from backups held by customers themselves, and advised customers to rebuild their systems in a separate environment. Customers who kept copies outside the affected zones can rebuild from them. Customers whose only copies were snapshots inside the platform were in a much weaker position.

Are cloud snapshots a backup?

A snapshot that lives on the same platform, under the same control plane and the same administrator credentials as the system it protects, fails in the same incident. An attacker who reaches the management layer can delete it along with the original. A recovery copy counts as a backup when it sits outside that control plane, under separate credentials, ideally immutable, and when someone has restored from it recently and timed the job.

Field Notes / Breach Analysis

A Ransomware Attack Took Down a Japanese Cloud. The Provider’s Advice Was: Restore From Your Own Backups.

Q: What did the IDCF Cloud attacker claim?

Screenshots customers captured before losing console access show a message headed “Your Cloud is Ours”. The attacker claims it took seven minutes to breach East Japan Region 1, reached 239 hypervisors, sealed 16,000 virtual machine disks, encrypted 225 databases holding 3.6 petabytes and wiped 554,153 snapshots. BleepingComputer and Cybernews could not verify these claims, and IDC Frontier has not confirmed them.

On 7 October 2026 ransomware shut down four zones of IDCF Cloud, a SoftBank-owned platform used by 495 companies and local governments. The next day IDC Frontier said data in those zones would be difficult to retrieve or restore, and pointed customers to backups they hold themselves. Here is what happened, what the attacker claims, and the three questions that tell you whether your own recovery depends on someone else’s control panel.

Author: Red Team Partners
Read: 9 MIN READ
Filed: 14 Oct 2026

The finding

Ransomware shut down four zones of IDCF Cloud, a Japanese infrastructure platform owned by SoftBank, from 03:40 on 7 October 2026. IDC Frontier said 495 companies and local governments were affected BleepingComputer 2026 . A day later it told them that data stored in those zones would be difficult to retrieve or restore, and that customers should rebuild elsewhere from backups they hold themselves Cybernews 2026 .

That advice is the lesson. Customers with a copy outside the platform started rebuilding. Customers whose only copies were snapshots inside the same cloud found out that their backup had been on the same platform as the system it was meant to protect. The attacker claims to have wiped 554,153 of those snapshots. Nobody has verified the number. It does not need to be exact to make the point.

01 What happened at IDCF Cloud, and when

DC Frontier rents out virtual servers, storage and networking from Japanese data centres, a domestic alternative to the American hyperscalers. Its customers run websites, applications and business systems on it. In the early hours of Wednesday 7 October the company shut down the network and systems of four zones in East Japan Region 1 and later attributed the outage to “a ransomware attack by a third party” BleepingComputer 2026 .

When	What IDC Frontier and others reported
7 Oct, 03:40	Attack begins in East Japan Region 1. Network and systems of four zones shut down.
7 Oct	Prefectural and municipal websites, Jiji Press and other corporate sites can no longer be viewed or updated nippon.com 2026 .
7 to 8 Oct	Customer access to management consoles disabled in every region while IDC Frontier checks their security.
8 Oct	Third report: data in the four zones expected to be difficult to retrieve or restore. Customers advised to rebuild in a separate environment from their own backups Cloud News 2026 .
9 to 10 Oct	Japan’s National Cybersecurity Office writes to ministries, local bodies and companies: “This is no longer just a problem for the IT department” Cybernews 2026 .

The damage reached well beyond websites. Cybernews lists the Ibaraki Prefectural Police, Jiji Press, the ticketing firm Skyticket and the e-commerce platform FutureShop among affected services, citing Japan Cyber Watch. JR East and its card subsidiary View Card said up to 6.09 million records may have been accessed through email-delivery services, and JR Kyushu reported 1.3 million email addresses. Nissui’s frozen-food logistics arm stopped receiving and shipping goods after an outage at a third-party data centre, though it is not confirmed that this outage is the same incident BleepingComputer 2026 .

Several things are still unknown as of 14 October. IDC Frontier has not said how the attacker got in, who it is, whether a ransom was demanded or whether data was stolen. Regions outside the four zones showed no confirmed unauthorised access in its latest reports.

02 Why “restore from your own backups” is the whole story

Every cloud contract says the same thing in small print. The provider keeps the platform running. You protect your data. Most customers read that as a formality, because the platform also sells snapshots, a button that copies your disks and keeps them a few clicks away. In normal life those snapshots work. You break a database, you roll back, you carry on.

Ransomware is the case they were never built for. A snapshot sits on the same storage, behind the same management layer, reachable by the same administrator who can reach the original. An attacker who controls that layer controls both copies. According to the ransom screen customers photographed before their consoles went dark, the attacker reached 239 hypervisors, sealed 16,000 virtual machine disks, encrypted 225 databases holding 3.6 petabytes and wiped 554,153 snapshots, all in seven minutes Cybernews 2026 . Those are the attacker’s figures. BleepingComputer and Cybernews could not verify them. IDC Frontier’s own advice to rebuild from customer-held backups fits them closely enough.

The second gap is the console itself. IDC Frontier switched off customer access to management consoles in every region while it checked them, including regions with no confirmed intrusion. That was a reasonable precaution. It also meant customers in unaffected regions could not log in to export, reconfigure or move their own systems for a time. A recovery plan that starts with “log in to the provider’s console” assumes the console is there.

03 One platform, 495 customers: the shared blast radius

A railway, a police force, a news agency and a frozen-food warehouse have little in common, apart from the data centre they shared. When one shared layer falls, every tenant behind it falls at once, whatever its own security was like. Shared hosting has always worked this way. What IDCF adds is scale and speed: if the seven-minute claim is close to true, the whole of East Japan Region 1 went down faster than most on-call engineers can open a laptop.

You cannot audit your provider’s hypervisors. You can decide how much of your business depends on one of them. In our engagements, we ask clients to name the single platform whose loss would stop them trading for a week. Most can, within a minute. Far fewer can show us a restore from outside that platform carried out in the last twelve months, with a time on it. That gap between the risk a client knows about and a recovery they have actually rehearsed is where incidents like this one get expensive.

04 Three questions for your recovery plan

Your board does not need a cloud architecture review to act on this. It needs three answers, each with evidence attached.

Ask this week

Where is the copy that the platform’s own administrators cannot delete? Name the system, the separate credentials and whether it is immutable. A snapshot in the same account or tenancy does not count.
When did someone last restore a critical system from that copy, and how long did it take? A backup nobody has restored from is a hope. Ask for the date and the hours.
What happens if the provider’s console is unavailable for a week? List what you can still export, rebuild or move without it, and who in your team does it.
Who holds your cloud administrator identities, and what stops one stolen login from reaching every system at once? Phishing-resistant MFA, separate break-glass accounts and limits on delete actions all shrink what one account can destroy.

IDC Frontier’s customers are rebuilding from whatever copies they kept off its platform. Your own answer to that question should come from a test run on a quiet Tuesday. We take one of your cloud administrator identities as the starting point, show you what an attacker holding it could delete or lock, and hand you the systems that have no copy outside its reach, ranked, with the fix for each. Start with your Threat Map: from $5,000, in 14 days.

References

Sources

BleepingComputer. Ransomware attack disrupts Japan’s IDCF Cloud used by govt clients. 8 October 2026. bleepingcomputer.com
Cybernews. Cyberattack on Japanese cloud firm hits railways, police and food suppliers, 495 organizations exposed. October 2026. cybernews.com
Nikkei xTech. IDCFクラウド障害、別環境での再構築を案内問われるクラウド停止への備え. October 2026. xtech.nikkei.com
nippon.com (Jiji Press). Cyberattack on SoftBank Unit Affects Local Govt, Corporate Websites. 7 October 2026. nippon.com
Cloud News (vpshikaku.com). IDCFクラウド第3報: 東日本1の4ゾーンでデータ復元困難の見通し. 8 October 2026. vpshikaku.com