-
A ransomware attack on IDC Frontier’s IDCF Cloud service has affected companies and local governments across Japan. 495 organizations face disruption.
-
Four cloud zones face major damage. Customers may need to rebuild their systems and restore data from their own backups.
-
JR East and View Card reported potential exposure involving 6.09 million email records. None of the companies reported that customer data was stolen.
A prominent Japanese cloud company has suffered a ransomware attack that has resulted in services being interrupted across multiple industries. Numerous companies have been impacted by the attack, including government organizations, train service providers, food suppliers, and online businesses.
According to IDCF’s update, the attack began on October 7, 2026, when criminals targeted IDCF Cloud, a service run by IDC Frontier. SoftBank owns the cloud provider, which serves businesses and public bodies across Japan.
IDC Frontier says the attack affected 495 companies and local government bodies. A lot of customers lost access to the companies’ servers. Others reported website outages and interruptions to their operations.
The negative impact of the attack may last for a long time even after the service interruption ends. IDC Frontier has warned that customers may struggle to recover data from four damaged cloud zones.
Four Cloud Zones Suffer Severe Damage
IDC Frontier detected unauthorized access at around 3:40 a.m. on October 7. The company later confirmed that ransomware caused the disruption. The attack hit four zones in East Japan Region 1: Tesla, Henry, Pascal, and Joule. Virtual servers stopped running, and customers could not restart them.
In its October 8 update, IDC Frontier warned that customers might not recover data stored in those zones. The company advised affected customers to build new systems elsewhere and restore their data from their own backups.
The provider also disconnected the affected region from its network. This step aimed to limit further damage and prevent possible data leaks. IDC Frontier has not announced a recovery date. Its fourth update reported no new major findings, while the investigation and recovery work continued.
The company also suspended management consoles across other regions as a precaution. It said investigators had not found unauthorized access in those other areas at the time of its October 8 update.
Attackers Claim Massive Data Destruction
The attack’s full scale remains unclear. IDC Frontier has not identified the criminals or explained how they entered its systems. It has also not confirmed whether the attackers demanded a ransom. Meanwhile, screenshots shared on social media reportedly show a message reading, “Your Cloud is Ours.”
The screenshots contain several dramatic claims. The attackers say they accessed 239 systems that run virtual machines. They also claim they locked 225 storage systems holding 3.6 petabytes of data.
Those same reports reveal that the perpetrators encrypted over 16,600 virtual machine disks and removed 554,153 backup snapshots. The threat actor reportedly said the operation took just seven minutes.
However, these figures remain unverified claims from the alleged attackers. IDC Frontier has not confirmed them, so readers should not treat them as established facts.
The distinction matters. Encrypted files, destroyed backups, and compromised data are all distinct processes. Investigators must determine which actions occurred before they can measure the full damage.
JR East and View Card Report Possible Exposure
Japan’s railway sector has emerged as a major concern. JR East, one of Japan’s largest railway operators, and its credit card subsidiary, View Card, reported possible exposure involving 6.09 million email records. The affected services used email delivery systems hosted on IDCF Cloud.
The reported total includes about 4.03 million View Card email addresses, 1.67 million Ekinet online reservation service addresses, and 390,000 addresses linked to JR East’s Otona no Kyujitsu Club travel membership service.
The companies said the incident did not expose credit card numbers, home addresses, or telephone numbers. However, they continue to investigate the possible exposure. Kyushu Railway Company also reported an incident involving roughly 1.3 million email records, according to published reports.
Those numbers do not mean that all of those records were stolen by the criminals. However, any of the exposed email addresses can be used for sending fraudulent emails about travel alerts or payments to the customers.
Government Services and Food Deliveries Disrupted
The outage has affected more than railway customers. Reportedly affected organizations include Ibaraki Prefectural Police, news agency Jiji Press, travel booking platform Skyticket, karaoke operator Daiichikosho, and online retail platform FutureShop. The SKE48 Mail fan messaging service has also faced disruption.
Several public websites experienced problems, including services linked to Ibaraki Prefecture and the city of Kodaira. The full list of affected customers remains unknown.
Food logistics have suffered too. Nissui Logistics, which handles frozen-food storage and distribution, reported problems that prevented it from receiving and shipping goods. Another ransomware incident in Japan’s food and beverage sector saw a gang claim an attack on Asahi Group, with a reported 1.5 million people affected.
The company later announced that some shipping and receiving operations would resume on October 9. It also said that the affected servers contained no personal or customer information maintained by the Nissui Group.
These disruptions show that a single cloud attack can affect several unrelated services. A failure at a single provider can interrupt public services, business operations, and food distribution at the same time.
IDC Frontier Works to Restore Services
IDC Frontier later revealed that it established an emergency response team on October 7. It has been working with SoftBank and external experts on cybersecurity to investigate the incident and assist its customers in this regard.
It is also helping customers recover from the situation using their backup data and preparing new environments and virtual servers. The company has also reported the incident to relevant authorities and police.
However, several questions remain unanswered. IDC Frontier has not disclosed the attackers’ entry point, confirmed the alleged backup deletions, or established how much data criminals may have stolen.
This incident demonstrates another essential learning point for cloud users: having their data with the cloud provider cannot be considered a substitute for independent backup.
Organizations should store copies of data in a place other than those maintained by the provider itself. Organizations should also test their recovery processes before any emergency happens.
For now, IDC Frontier confirms that 495 organizations experienced an impact and four cloud zones suffered severe damage. The final scope of the attack remains unknown.
