IDCF Cloud ransomware hits 495 Japanese clients

IDC Frontier confirms ransomware caused the IDCF Cloud outage

IDC Frontier has confirmed that a ransomware attack by an outside party caused the IDCF Cloud outage. IDC Frontier is a Japanese data center and cloud company owned by the telecom group SoftBank. IDCF Cloud is its infrastructure service that businesses and local governments rent to run websites and internal systems.

Ransomware is malicious software that encrypts data so it can't be used, then demands payment to unlock it. The attack hit part of IDC Frontier's East Japan Region 1. In IDCF Cloud, a region is a geographic group of data centers, and a zone is a smaller section inside a region.

The IDCF Cloud outage began in East Japan Region 1 on October 7

The trouble started at about 3:40 a.m. Japan time on October 7, 2026, in East Japan Region 1. In its first report that day, IDC Frontier said unauthorized access by a third party had knocked out part of the service.

The company said it was contacting affected customers one by one. That first notice did not yet say what kind of attack it was or how many customers were involved.

IDC Frontier traced the cloud outage to a ransomware attack

A second report later on October 7 named ransomware as the cause. To keep the damage from spreading and to block data from leaking, IDC Frontier cut East Japan Region 1 off from the network and shut its systems down.

At that point the company was still working to find and close the route the attackers used. It has issued four reports in total, summarized in the list at the top of this section.

IDCF Cloud ransomware recovery depends on customer backups

The attack affects 495 companies and local governments that use IDCF Cloud. IDC Frontier gave that figure in both its second and third reports. It has not named the customers and is notifying them individually.

The ransomware attack hit 495 IDCF Cloud customers across four zones

The damage is concentrated in four zones of East Japan Region 1: tesla, henry, pascal and joule. According to the third report, virtual servers in those zones stopped and cannot be restarted. A virtual server is a server that a customer rents in the cloud to run its own websites and systems.

The radian and newton zones of the same region are not on the list. IDC Frontier has reported damage in only those four zones.

IDC Frontier says ransomware recovery needs customers' own backups

IDC Frontier expects that data stored in the four zones will be hard to extract or restore. In the company's view, the only way to get it back is from backups customers keep themselves, meaning copies made outside IDCF Cloud.

Customers in those zones are being told to rebuild on a separate environment. If IDC Frontier's assessment holds, a customer with no backup has no way to bring back the data that sat in those zones.

IDC Frontier paused IDCF Cloud consoles in other regions

Management consoles in every other region are also offline for now. A management console is the web panel customers use to start, stop and configure their own servers. IDC Frontier plans to switch them back on once it confirms they are safe.

The third report names three areas where no unauthorized access has been confirmed. They are:

• The radian and newton zones of East Japan Region 1
• East Japan Region 2 and East Japan Region 3
• West Japan Region 1

IDC Frontier is still asking those customers to back up their data. While the consoles are down, it will start or stop a customer's virtual servers on request. IDCF Cloud TypeS and IDCF Private Cloud are not part of the incident.

JR East reports a possible data breach tied to the IDCF Cloud outage

Several IDCF Cloud customers have published their own notices about the outage. This report covers the three whose statements could be checked on their own websites.

JR East: up to 1.67M Eki-net addresses in a possible data breach

East Japan Railway Company (JR East) said on October 9 that personal data of members of two of its services may have leaked. Eki-net is JR East's online train ticket booking service, and Otona no Kyujitsu Club is its travel membership program for older riders. An outside email-delivery service JR East uses to send messages to those members went partly offline because of the IDC Frontier incident.

JR East says it cannot rule out that email log data, including some members' email addresses, was viewed or taken. The maximum numbers are about 1.67 million Eki-net members and about 390,000 Otona no Kyujitsu Club members. JR East has not given a combined total.

Names, addresses, phone numbers and credit card numbers are not at risk, according to JR East. The railway plans to email affected members individually once it is ready.

Nissui Logistics shipping halted by the IDCF Cloud outage

Nissui Logistics, a logistics company in the Nissui seafood group, has had a system outage since unauthorized access hit its cloud provider IDC Frontier. Inbound and outbound shipments stopped, and some of that work resumed on October 9.

Nissui says it has confirmed that the affected servers held no personal or customer information managed by the group. It will announce separately when full recovery is expected.

Movable Type restored 31 servers from backups after the cloud outage

Six Apart, which runs the hosted Movable Type cloud edition, had 31 servers on its IDCF Cloud plan knocked out. Customers on those servers could not reach their admin screens or websites, and Six Apart says the servers cannot be restored on IDCF Cloud.

Six Apart keeps the last seven daily backups of every server on Google Cloud, separate from IDCF Cloud. It is using the backups taken at 1:00 a.m. on October 7 to move the 31 servers to Sakura Cloud, another Japanese cloud, and is restoring them in turn.

SoftBank and IDC Frontier lead the response as the probe continues

IDC Frontier set up an emergency headquarters at 9 a.m. on October 7 and is working with its parent company SoftBank. The fourth report, issued October 9, laid out who handles customers and who handles the investigation.

SoftBank's enterprise division handles IDCF Cloud customers

IDCF Cloud customers now go through SoftBank's enterprise division. The division handles three things for them:

• Guidance on how to back up their data
• Proposals for environments to migrate to
• Starting and stopping virtual servers on their behalf

IDC Frontier's engineers lead the investigation and recovery, with SoftBank's engineers in support. Outside security firms are also examining networks, servers and storage in both the East Japan and West Japan regions.

IDC Frontier has not disclosed the intrusion route or a data breach

IDC Frontier has not said how the attackers got in, or whether any data was taken from IDCF Cloud. The third report says the detailed scope and the intrusion route are still under investigation.

The company has reported the incident to the relevant government ministries and to the Tokyo Metropolitan Police Department, and is weighing measures to prevent a repeat. It says it will publish any new facts as soon as they are confirmed.

IDCF Cloud ransomware leaves data recovery to customer backups

The IDCF Cloud ransomware attack disrupted 495 companies and local governments, and data in four zones is expected to come back only from customers' own backups. Customers that kept copies elsewhere, like Six Apart with its Google Cloud backups, are already moving to other clouds.

JR East has warned that member email addresses may have been exposed. IDC Frontier's next reports should say how the attackers got in and whether data left IDCF Cloud.