Ransomware at SoftBank's IDCF Cloud leaves 495 clients holding the backup risk

A ransomware attack on IDCF Cloud, the infrastructure-as-a-service platform run by IDC Frontier, a member of the SoftBank group, has knocked out services for 495 companies and local governments in Japan. The outage began at about 3:40 a.m. local time on Wednesday, October 7, in the provider's East Japan Region 1. By the evening of Thursday, October 8, the company had told customers something that no tenant of a cloud platform wants to hear: data in 4 of the affected zones is likely to be difficult to extract or restore, and for now the only route back is through backups the customers hold themselves.

The incident is first of all an operational emergency for the organisations caught in it. For investors, it is something broader: a live test of who carries the financial risk when a shared infrastructure provider fails, and the early answer is that much of it sits with the customer.

What IDC Frontier has disclosed

In its second notice, published on October 7, IDC Frontier said a disruption in East Japan Region 1 had been caused by a ransomware attack by a third party. It cut the region off from its network and shut its systems down to prevent secondary damage and data leakage. As a precaution it also suspended the customer-facing management consoles in its other regions while it checks their safety, and said it was working to identify and block the intrusion route.

The third notice, dated October 8, narrowed the damage to the tesla, henry, pascal and joule zones of East Japan Region 1, where virtual servers stopped and could not be restarted. Customers in those zones were advised to prepare a separate environment and rebuild. In the radian and newton zones of the same region, in East Japan Regions 2 and 3 and in West Japan Region 1, the company said no unauthorised access had been confirmed, but it still urged customers to back up their own data. Because consoles remain offline, IDC Frontier is starting and stopping virtual servers on request. It said it is working with an outside security firm, has reported to government regulators and the Metropolitan Police Department, and that IDCF Cloud Type S and IDCF Private Cloud are outside the scope of the incident.

The company has not named the attacker, nor said how the intruders got in or whether data was stolen. Both questions remain under investigation.

The claims that matter, if true

BleepingComputer reported on October 8 that screenshots circulating after the attack show a message in which the perpetrators claim to have breached the environment in 7 minutes, reached 239 hypervisors, encrypted 225 databases holding 3.6 PB, sealed 16,000 virtual machine disks and wiped 554,153 snapshots. None of these figures has been confirmed by IDC Frontier, and they should be treated as an extortion group's advertisement rather than as fact.

Yet the claims are consistent with the one thing the provider has confirmed: that data in the affected zones may be beyond recovery. An attack that reaches the hypervisor layer and destroys snapshots defeats the most common form of resilience that customers buy from a cloud provider, because snapshots stored on the same platform fall with it. That is precisely why IDC Frontier is now pointing to backups held by customers outside its systems.

Downstream: the SaaS layer feels it first

The first visible casualties are not the 495 contract holders themselves but the businesses built on top of them. Impress Watch reported on October 8 that 31 servers running the cloud edition of Movable Type, the content management system sold by Six Apart, had been affected, leaving administration screens and websites unavailable. Six Apart said it did not expect recovery on IDCF Cloud and was moving customers to Sakura Internet's Sakura Cloud using backup data. Greenwich partly suspended 3 services, including its Rakuraku Zaiko inventory tool, so inventory synchronisation and price updates stopped.

Six Apart's position is instructive. On June 11, 2026, it had launched a Sakura Cloud plan for the same product, adding a second infrastructure option alongside the IDCF Cloud it had used until then. That decision, taken months before the attack, is what gives it somewhere to go this week. Many smaller software vendors running on a single regional cloud will not have that option, and their own customers will discover it only now.

BleepingComputer also noted that Nissui Logistics, part of the seafood and food group Nissui, reported a system outage linked to suspected unauthorised access at a third-party data centre, leaving it unable to ship or receive goods. Whether that incident is connected to IDCF Cloud is not clear.

A rising tide in Japan

The attack does not arrive in isolation. According to figures from the Japanese security company Macnica cited by BleepingComputer, there have been 119 incidents in Japan involving personal information theft or exposed data since the start of 2026, 83 of them between July 1 and October 6. Macnica counted 84 such incidents in 2025 and 62 in 2024 on the same basis. A year-to-date total already well above the full-year figure for 2025, with most of it in the last 3 months, points to an accelerating campaign against Japanese organisations rather than a run of bad luck.

Who pays

The financial consequences will take weeks to surface, but the shape is already visible. For IDC Frontier and its parent, the costs include incident response, restoration of a region, the commercial damage of telling customers that their data may be gone, and the possibility of churn as clients follow Six Apart's example and add or switch providers. The notices published so far say nothing about compensation.

For tenants, the exposure depends on preparation. Those with recent off-platform backups face rebuild costs and downtime. Those that relied on the provider's own snapshots, or on a software vendor that did, may face permanent data loss, with whatever contractual, regulatory and reputational consequences follow. Because the client base includes local governments, the episode will also feed into public procurement debates about how much resilience a domestic cloud must prove.

For the cyber insurance market, a single event that hits hundreds of policyholders through one supplier is the kind of aggregation scenario underwriters model and fear. How claims from this incident are handled will be watched closely.

Our view

The shared responsibility model has always said that customers own their data and their backups. This week IDC Frontier turned that clause from fine print into the operating plan. Founders running software businesses on a single cloud region should read that as a direct balance sheet question: if the platform vanished overnight, how many days of revenue and how many customer relationships would survive? Investors doing diligence on infrastructure-dependent startups should ask for evidence of tested, off-platform restores, not a reference to the provider's snapshot feature. Six Apart's second-cloud decision in June now looks less like redundancy and more like insurance that paid out. We also expect the incident to strengthen the commercial case for immutable backup and recovery vendors in Japan, and to sharpen scrutiny of concentration risk in public sector cloud contracts. The questions to watch are how IDC Frontier and SoftBank handle compensation, whether the attacker's claims are confirmed, and whether any data was taken as well as destroyed.

Sources

• IDC Frontier: Second report on unauthorised access to part of our systems (October 7, 2026)
• IDC Frontier: Third report, service disruption caused by unauthorised access (October 8, 2026)
• BleepingComputer: Ransomware attack disrupts Japan's IDCF Cloud used by govt clients
• Impress Watch: IDCF Cloud outage caused by ransomware attack, 495 companies and local governments affected
• Six Apart: Movable Type cloud edition launches Sakura Cloud plan (June 11, 2026)

Filed under Cybersecurity. Written by InvestTimes Editorial under our editorial standards. Commentary and analysis for information only, not investment advice.