What happened
At about 3:40 a.m. JST on October 7, 2026, IDCF Cloud, run by SoftBank subsidiary IDC Frontier, was hit by ransomware. Virtual machines in East Japan Region 1 stopped and wouldn't restart. The company cut the network, shut down systems, and set up an emergency HQ with SoftBank at 9 a.m.
495 corporate and local-government customers were affected.
Who felt it
- Nissui Logistics (Nissui group): logistics halted at 17 sites across Japan, affecting about 1,200 partners including retailers, restaurants and wholesalers.
- Ibaraki Prefecture: prefectural government and police websites went offline.
- JR East: up to 6.09 million customer accounts may be exposed (email addresses).
- JR Kyushu: about 1.3 million accounts possibly exposed.
The companies say they've seen no misuse so far.
The worst detail: unrecoverable data
In its 3rd notice (Oct 8), IDC Frontier said customer data stored in four zones (tesla, henry, pascal and joule) will be difficult to extract or restore. Recovery is only possible from backups customers keep themselves. Customers in those zones are being told to rebuild in a different environment. The management console remains down; the company starts and stops VMs on request.
No unauthorized access has been confirmed in other zones and regions, but IDC Frontier asked all customers to back up on their own.
What's claimed, not confirmed
Per analysis on Yahoo! News Japan, the attackers claim they reached 239 ESXi hypervisors and encrypted over 16,600 VM disks. IDC Frontier says details are under investigation; these figures are unconfirmed. No group has been officially identified and the entry point is still unknown.
Why it matters
It's concentration risk: one cloud provider hit takes down food logistics, public websites and major railway data at once. It also breaks a common myth: "it's in the cloud" doesn't mean "it's backed up." Under shared responsibility, customers without their own copies may have lost everything in those zones.
It adds to a heavy season in Japan: Keio (Sep 26), Osaka Metropolitan University (Oct 2), Skyticket, Big Echo and Bookoff.
What to do now
- Keep backups outside your main provider, or at least in a separate account with separate credentials, with an immutable copy.
- Test restores and measure how long a rebuild in another cloud takes.
- Map third-party dependencies: which critical systems rely on a single vendor?
- Harden the virtualization layer (ESXi/vCenter): isolated management network, MFA, current patches.
- Prepare customer communications for when a vendor goes down.
Sources
- IDC Frontier, 3rd notice (2026-10-08): https://www.idcf.jp/news/topics/20261008001
- IDC Frontier, 4th notice (2026-10-09): https://www.idcf.jp/news/topics/20261009001
- The Asahi Shimbun (2026-10-08): https://www.asahi.com/ajw/articles/16950581
- The Japan Times / Jiji (2026-10-10): https://www.japantimes.co.jp/business/2026/10/10/tech/japanese-firms-data-breaches/
- Yahoo! News Japan, Kenta Yamaguchi: https://news.yahoo.co.jp/expert/articles/cce6d03439ffb1d2d6de2500240634b394731753
Want to review backup, recovery and cloud-vendor dependency? KGA IT offers a free consultation: kga-it.com.