Ransomware cripples Japan's IDCF Cloud, hitting 495 customers including local authorities

Japanese provider IDC Frontier, a subsidiary of the SoftBank group, has confirmed that a ransomware attack caused the outage of its IDCF Cloud service. The attack began on October 7 at around 3:40 a.m. Japan time and hit the "East Japan 1" region, a set of data centers serving the east of the country.

495 customers cut off

According to BleepingComputer, 495 businesses and local authorities are affected. To contain the attack, IDC Frontier isolated and shut down the systems in the affected region. As a precaution, customer access to administration consoles was cut off in all regions while their security is verified. No timeline for restoring service has been announced.

Data "difficult to recover"

In an update published on October 8, IDC Frontier warned that customer data stored in part of the affected region would be "difficult to recover or restore." Affected customers are asked to rebuild their systems from their own backups. No unauthorized access has been detected in the other regions, although their consoles remain suspended. The company is still investigating whether data was stolen and how the attackers got in.

Claims to be treated with caution

Customers shared screenshots of a message attributed to the attackers. They claim to have compromised the region in seven minutes, encrypted 225 databases (3.6 PB), reached 239 hypervisors and deleted more than 550,000 backup snapshots. These figures have not been confirmed by IDC Frontier, which is continuing its investigation. No group has publicly claimed the attack.

Why it matters

The incident shows a risk that is often underestimated: when an infrastructure provider is hit, all of its customers go down at the same time. Backups stored with the same provider can disappear along with production systems. A few principles to check in your contracts and your architecture:

• keep a copy of your backups outside the main provider, ideally immutable;
• regularly test a full restoration on a different infrastructure;
• know the provider's commitments on incident notification and business recovery.

Japan is seeing a sharp rise in incidents: the company Macnica has recorded 119 thefts or exposures of personal data since the beginning of 2026, compared with 84 over the whole of 2025.