IDCF Cloud Ransomware: 495 Customers Lost a Region Overnight

At about 3:40 a.m. Japan time on 7 October 2026, a ransomware attack hit IDCF Cloud, the public cloud service run by IDC Frontier, a SoftBank subsidiary. The company shut down its East Japan Region 1, suspended customer management consoles in every other region, and said 495 companies and local governments were affected. By its third update, IDC Frontier was telling customers in the hit zones that their data could only be restored from backups they held themselves.

This is a cloud provider incident, not a breach of any one customer. That is what makes it worth studying if you buy infrastructure, or buy software from vendors who do.

What's affected

Based on IDC Frontier's own notices (reports two through six, published 7 to 18 October):

• Service: IDCF Cloud. IDC Frontier says IDCF Cloud TypeS (formerly White Cloud ASPIRE) and IDCF Private Cloud are not part of the incident.
• Region and zones: East Japan Region 1, specifically the tesla, henry, pascal and joule zones. Virtual servers there were stopped and could not be restarted.
• Customers: 495 companies and local governments that contract for IDCF Cloud. Each was contacted individually.
• Consoles: Customer management consoles for all other regions were taken offline while the company checked them. During that period, IDC Frontier staff started and stopped customer servers on request.
• Backups: The fifth report (14 October) said snapshot backup data had been checked and found safe, and that 194 of the 495 customers had used the snapshot feature and could get their backup data back. The sixth report (18 October) said the separate IDCF Cloud Backup service was resuming, while the snapshot feature stayed suspended.
• Data leakage: The same fifth report said the company found no evidence that data inside customer virtual machines in the affected zones was queried or taken out. It did confirm unauthorized lookups of registration data for 48 companies through the IDCF Cloud Portal: company name, portal login ID, hashed portal password, notification email addresses and total monthly fees.

How the attacker got in has not been published. IDC Frontier says it is working with an outside security firm to identify and block the intrusion route. BleepingComputer reported attacker claims about the scale of encryption and snapshot deletion, taken from screenshots shared by customers. Those claims are not confirmed by the provider, so plan on the provider's numbers.

How to check if you're exposed

Start with your own accounts, then move to your vendors.

1. Direct customers. If you run anything on IDCF Cloud, IDC Frontier will have contacted you. Confirm which zone each of your virtual servers ran in and whether you used the snapshot feature.
2. Portal records. If your company is among the 48 whose portal data was looked up, assume your portal login ID and notification addresses are known to someone else. Watch those addresses for targeted phishing.
3. Indirect exposure through vendors. Many SaaS and managed service providers host on regional clouds without saying so in their marketing. Check which of your suppliers resolve to IDCF address space:

# Resolve a vendor hostname, then look up who owns the IP
dig +short app.example-vendor.jp
whois 203.0.113.10 | grep -iE 'netname|org|descr'

Do this for every hostname in your vendor inventory, not only the ones you think of as critical. Payroll, ticketing and email delivery providers are often the ones you forget.

4. Ask the question in writing. For vendors that do not answer DNS questions cleanly (CDNs hide origins), send a short request: "Was any service you provide to us hosted on IDCF Cloud East Japan Region 1 between 1 and 18 October 2026?"

What to do now

1. Test that you can restore without the provider. IDC Frontier's third report said affected customers should rebuild in a separate environment and restore from their own backups. If your only copies of data live in the same provider's snapshot service, you have one copy, not two.
2. Take an outside backup today if you are in an unaffected region. IDC Frontier asked customers in the radian and newton zones, East Japan Regions 2 and 3, and West Japan Region 1 to back up their data as a precaution. The resumed backup service is intended to help move data to other clouds or on premises.
3. Rotate portal credentials and review notification contacts. The provider has not asked customers to change portal passwords in its published notices, but a hashed password plus login ID is enough reason to rotate if you were among the 48.
4. Write down the console dependency. After the attack, customers in regions with no confirmed intrusion still lost their management consoles while the provider checked them. List which of your runbooks assume console access to stop, start, resize or snapshot a server.
5. Update your vendor register. Record every supplier that confirmed IDCF hosting, what data they hold for you, and their restore plan.

Why it matters

Cloud providers are suppliers too, and they rarely show up on a software bill of materials. When one is hit, every tenant shares the outage window, and the provider's own backup tools may be offline at the same time as the servers they protect.

The parts of this incident that hurt most were not exotic. Backups stored inside the affected platform, consoles that customers depended on for basic operations, and a vendor list that did not record where each vendor actually runs. Those are all things you can check this week.

Try it yourself

Pick your five most important SaaS vendors. For each, find out which cloud provider and region hosts the data they hold for you, and whether you have a copy of that data outside their platform. If you cannot answer for at least three of the five, that is your first vendor review item.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• IDC Frontier: second report, 7 October 2026
• IDC Frontier: third report, 8 October 2026
• IDC Frontier: fifth report, investigation progress, 14 October 2026
• IDC Frontier: sixth report, backup service resumption, 18 October 2026
• BleepingComputer: Ransomware attack disrupts Japan's IDCF Cloud used by govt clients