Japanese cloud provider IDCF Cloud hit by ransomware, 495 customers affected

According to a BleepingComputer report dated 8 October 2026, IDC Frontier, a SoftBank Group subsidiary, disclosed a ransomware attack on IDCF Cloud, its service for renting virtual servers, storage and networking. The company says the attack started at 3:40 AM local time on 7 October 2026, after which the network and systems in East Japan Region 1 had to be shut down. It puts the number of affected companies and local governments at 495.

• To stop the spread, IDC Frontier cut off and powered down the affected systems, and it is tracing and blocking the attackers' way in while reviewing security in its other regions.
• Customers currently cannot reach their management consoles in any region; the company will restore access once it confirms it is safe.
• In screenshots customers took before losing console access, the attacker says it needed seven minutes to get in and claims it got into 239 hypervisors, sealed off 16,000 virtual machine disks and erased 554,153 snapshots; the report presents these as the attacker's claims.
• Security firm Macnica has logged 119 cyber incidents involving stolen or exposed personal data in Japan since the start of 2026, 83 of them between 1 July and 6 October.

Why it matters

Because the attack targeted a cloud provider's infrastructure, one incident hit hundreds of customers at once. The attacker's claim that snapshots were also wiped is a reminder that keeping backups only with the same provider and in the same region could be risky. Companies in Türkiye that run servers in the cloud would benefit from checking that at least one backup copy is kept in a separate environment and that restores have been tested.

The report also notes that Nissui Logistics, the logistics unit of Nissui, had a system outage after suspected unauthorized access to a third-party data center it uses; whether this is linked to the IDCF Cloud attack is unclear.