A large-scale ransomware attack paralyzed part of the Japanese cloud platform IDCF Cloud, on which hundreds of companies and government agencies depend. 495 organizations were affected, and the operator of the IDC Frontier cloud warned that it would probably not be possible to restore data on damaged servers in-house. Customers without separate backups are threatened with irrevocable loss of information.
The incident occurred on October 7 at around 03:40 Japanese time. The attackers entered the infrastructure of East Japan Region 1, one of the regions of the cloud platform belonging to the subsidiary of SoftBank. IDC Frontier confirmed the attack using the ransomware and disconnected the damaged systems from the network to stop the malware from spreading further.
The most serious consequences affected four areas of accessibility under the names tesla, henry, pascal and joule. The virtual servers placed there stopped and are no longer launched. IDC Frontier has acknowledged that it will be extremely difficult to extract or recover client data stored on damaged sites. According to the company's current assessment, it is possible to return the information only from the backup copies that the customers have kept on their own.
The affected organizations were offered to deploy information systems anew at other venues. For customers using the two remaining zones of the first eastern region, other eastern regions and the western region, there are no confirmed cases of penetration yet. However, the provider recommended that the backups be maintained on their own and temporarily closed access to management panels in all regions. While security checks are not completed, IDC Frontier engineers manually perform virtual machine operations, including the start and stop of servers, on request of customers.
The consequences of the attack have already gone far beyond the cloud provider itself. On October 9, the Japanese railway company JR East warned about the possible compromise of personal data of customers after the hacking of the infrastructure of IDC Frontier. Through the affected contractor, e-mails were sent to the participants of the ticket booking service "Ekinet" and the loyalty program "Adult Weekend Club". About 1.67 million and 390 thousand records were threatened, respectively.
In addition to the electronic addresses, the participants of the loyalty program could reveal the dates of birth, the number of participants and the validity of bank cards. At the same time JR East did not find grounds to believe that the intruders became available names, addresses, phones or full card numbers. The subsidiary of the railway operator View Card separately reported the risk of leakage of approximately 4.03 million electronic addresses. In total, we are talking about about 6.09 million records, although some customers can be present in several databases. The fact of copying information by intruders has not yet been confirmed.
A clear example of the consequences for business was presented by Six Apart, the developer of the Movable Type site management system. After the IDCF Cloud was disabled, 31 servers of the cloud version of the platform stopped working, together with the sites and administrative panels placed on them. The company admitted that it will not be possible to restore damaged servers in the original infrastructure. By October 8, all 31 servers had been transferred to Sakura Cloud, using backups made on October 7 at 01:00, shortly before the attack. Copies were stored in Google Cloud, separate from the damaged infrastructure. This approach allowed the systems to be returned to work, although the changes made after the creation of the last copy could not be saved.
The scale of the alleged destruction was even more serious in the message, which the attackers left right in the administrative console IDCF Cloud. The screenshots of the interface managed to save users before disabling access. In circulation, the criminals claimed that they took only seven minutes to encrypt the East Japan Region 1 infrastructure.
According to the attackers, they managed to access 239 hypervisors, encrypt all 225 data warehouses with a total volume of 3.6 petabytes, disable more than 16,600 virtual disks and destroy 554 153 scans of the state of systems. The attackers also announced the loss of 41.5 petabytes of backup storage capacity. IDC Frontier did not confirm the figures, so it is not yet possible to assess the real extent of the destruction according to the report of criminals.
Especially dangerous is the alleged capture of hypervisors, software components that manage virtual machines on physical servers. Having gained control over this level of infrastructure, the attacker is potentially capable of disabling many client systems. Destroying status shots further complicates recovery, as administrators lose the ability to quickly roll back damaged machines to the previous state. That is why individual backups, not available from compromised infrastructure, remain one of the most reliable ways to recover from ransomware attacks.
It is not yet known how criminals initially entered IDCF Cloud and whether the vulnerability of a particular software product was exploited. Also, the name of the group, possible ransom requirements and the fact of mass withdrawal of client information outside the cloud are not established. IDC Frontier has engaged external information security specialists, checks servers, networks and storage systems in different regions. On October 7, the company established an anti-crisis headquarters, and on October 9 confirmed that the reconstruction work is underway with the technical and organizational support of the parent SoftBank. As of the evening of October 11, the investigation and reconstruction continued.
At the same time, Japan has problems with the logistics company Nissui Logistics, which is part of a large food group Nissui. Due to the failure of information systems, the company suspended the reception and dispatch of goods. The management suggests that the reason was unauthorized access to the infrastructure of the third-party data center, and checks the possible leakage of personal and client information. However, there is no evidence that the failure of Nissani Logistics is connected with the hacking of IDCF Cloud.
The attack on the cloud provider occurred against the background of a sharp increase in the number of other incidents in the Japanese Internet. Macnica specialist Utaka Sadziyama analyzed public reports of hacking of web systems with theft or disclosure of personal data. For 2024, the researcher counted 62 such cases, for 2025 registered 84, and in the first nine months and six days of 2026 alone, 119 have already been recorded. And 81 cases occurred between July and 6 October. The study covers a certain category of attacks and does not include incidents involving ransomware, so statistics do not prove links between individual incidents.
According to Sadziyama, criminals are increasingly looking for flaws in checking access rights, authentication settings, and API software interfaces, and exploit long-known vulnerabilities. Previously, finding individual errors on a variety of small sites required significant resources. The researcher suggests that available AI-powered tools could have cheapened and accelerated such work, making even little-noticed resources attractive goals. There is no direct evidence of the use of AI in the attack on IDC Frontier.
The main problem for IDCF Cloud customers now is not only a long-lasting downtime. Even after the localization of the attack, organizations will have to re-deploy applications, return the data and check the security of the restored systems. The Movable Type experience shows that independent backups allow you to restore work on another platform, while customers who have fully trusted the storage and recovery of information to one provider may simply have nowhere to return lost data.
The incident occurred on October 7 at around 03:40 Japanese time. The attackers entered the infrastructure of East Japan Region 1, one of the regions of the cloud platform belonging to the subsidiary of SoftBank. IDC Frontier confirmed the attack using the ransomware and disconnected the damaged systems from the network to stop the malware from spreading further.
The most serious consequences affected four areas of accessibility under the names tesla, henry, pascal and joule. The virtual servers placed there stopped and are no longer launched. IDC Frontier has acknowledged that it will be extremely difficult to extract or recover client data stored on damaged sites. According to the company's current assessment, it is possible to return the information only from the backup copies that the customers have kept on their own.
The affected organizations were offered to deploy information systems anew at other venues. For customers using the two remaining zones of the first eastern region, other eastern regions and the western region, there are no confirmed cases of penetration yet. However, the provider recommended that the backups be maintained on their own and temporarily closed access to management panels in all regions. While security checks are not completed, IDC Frontier engineers manually perform virtual machine operations, including the start and stop of servers, on request of customers.
The consequences of the attack have already gone far beyond the cloud provider itself. On October 9, the Japanese railway company JR East warned about the possible compromise of personal data of customers after the hacking of the infrastructure of IDC Frontier. Through the affected contractor, e-mails were sent to the participants of the ticket booking service "Ekinet" and the loyalty program "Adult Weekend Club". About 1.67 million and 390 thousand records were threatened, respectively.
In addition to the electronic addresses, the participants of the loyalty program could reveal the dates of birth, the number of participants and the validity of bank cards. At the same time JR East did not find grounds to believe that the intruders became available names, addresses, phones or full card numbers. The subsidiary of the railway operator View Card separately reported the risk of leakage of approximately 4.03 million electronic addresses. In total, we are talking about about 6.09 million records, although some customers can be present in several databases. The fact of copying information by intruders has not yet been confirmed.
A clear example of the consequences for business was presented by Six Apart, the developer of the Movable Type site management system. After the IDCF Cloud was disabled, 31 servers of the cloud version of the platform stopped working, together with the sites and administrative panels placed on them. The company admitted that it will not be possible to restore damaged servers in the original infrastructure. By October 8, all 31 servers had been transferred to Sakura Cloud, using backups made on October 7 at 01:00, shortly before the attack. Copies were stored in Google Cloud, separate from the damaged infrastructure. This approach allowed the systems to be returned to work, although the changes made after the creation of the last copy could not be saved.
The scale of the alleged destruction was even more serious in the message, which the attackers left right in the administrative console IDCF Cloud. The screenshots of the interface managed to save users before disabling access. In circulation, the criminals claimed that they took only seven minutes to encrypt the East Japan Region 1 infrastructure.
According to the attackers, they managed to access 239 hypervisors, encrypt all 225 data warehouses with a total volume of 3.6 petabytes, disable more than 16,600 virtual disks and destroy 554 153 scans of the state of systems. The attackers also announced the loss of 41.5 petabytes of backup storage capacity. IDC Frontier did not confirm the figures, so it is not yet possible to assess the real extent of the destruction according to the report of criminals.
Especially dangerous is the alleged capture of hypervisors, software components that manage virtual machines on physical servers. Having gained control over this level of infrastructure, the attacker is potentially capable of disabling many client systems. Destroying status shots further complicates recovery, as administrators lose the ability to quickly roll back damaged machines to the previous state. That is why individual backups, not available from compromised infrastructure, remain one of the most reliable ways to recover from ransomware attacks.
It is not yet known how criminals initially entered IDCF Cloud and whether the vulnerability of a particular software product was exploited. Also, the name of the group, possible ransom requirements and the fact of mass withdrawal of client information outside the cloud are not established. IDC Frontier has engaged external information security specialists, checks servers, networks and storage systems in different regions. On October 7, the company established an anti-crisis headquarters, and on October 9 confirmed that the reconstruction work is underway with the technical and organizational support of the parent SoftBank. As of the evening of October 11, the investigation and reconstruction continued.
At the same time, Japan has problems with the logistics company Nissui Logistics, which is part of a large food group Nissui. Due to the failure of information systems, the company suspended the reception and dispatch of goods. The management suggests that the reason was unauthorized access to the infrastructure of the third-party data center, and checks the possible leakage of personal and client information. However, there is no evidence that the failure of Nissani Logistics is connected with the hacking of IDCF Cloud.
The attack on the cloud provider occurred against the background of a sharp increase in the number of other incidents in the Japanese Internet. Macnica specialist Utaka Sadziyama analyzed public reports of hacking of web systems with theft or disclosure of personal data. For 2024, the researcher counted 62 such cases, for 2025 registered 84, and in the first nine months and six days of 2026 alone, 119 have already been recorded. And 81 cases occurred between July and 6 October. The study covers a certain category of attacks and does not include incidents involving ransomware, so statistics do not prove links between individual incidents.
According to Sadziyama, criminals are increasingly looking for flaws in checking access rights, authentication settings, and API software interfaces, and exploit long-known vulnerabilities. Previously, finding individual errors on a variety of small sites required significant resources. The researcher suggests that available AI-powered tools could have cheapened and accelerated such work, making even little-noticed resources attractive goals. There is no direct evidence of the use of AI in the attack on IDC Frontier.
The main problem for IDCF Cloud customers now is not only a long-lasting downtime. Even after the localization of the attack, organizations will have to re-deploy applications, return the data and check the security of the restored systems. The Movable Type experience shows that independent backups allow you to restore work on another platform, while customers who have fully trusted the storage and recovery of information to one provider may simply have nowhere to return lost data.
