On 7 October 2026, a ransomware attack took down part of IDCF Cloud, the infrastructure-as-a-service platform run by IDC Frontier, a SoftBank Corp. subsidiary. The provider says 495 companies and local governments were affected. In the days that followed, customers disclosed knock-on effects. JR East and JR Kyushu warned that millions of accounts held in email-delivery services "may have been compromised". Seafood group Nissui's logistics subsidiary stopped shipping. Prefectural websites went offline. The attack landed in a week when Japanese companies disclosed tens of millions of exposed or possibly exposed records, and when eight government agencies issued warnings.
Technical Information
- What IDC Frontier has confirmed:
- The disruption in East Japan Region 1 "was caused by a ransomware attack by a third party". It began at about 03:40 JST on 7 October (21:40 IDT on 6 October).
- The affected zones are tesla, henry, pascal and joule. The rest of East Japan Region 1, the other regions, IDCF Cloud TypeS and IDCF Private Cloud were not affected at the service level.
- It disabled management-console access in all regions while it checked them.
- Data: in its 14 October update, IDC Frontier says it found no trace of data in customer virtual servers being viewed or taken out, and judges that no data leaked externally. Separately, attackers improperly viewed registration records for 48 customer companies in the IDCF Cloud Portal. The records include login IDs, hashed passwords and notification email addresses. IDC Frontier found no trace that this data was taken out.
- Recovery: on 8 October, IDC Frontier said data in the four zones was unlikely to be recoverable. On 14 October it said backups had been verified as safe, and that 194 of the 495 affected customers, the ones who used its snapshot feature, can retrieve their backup data. The others must restore from their own backups.
- How they got in: IDC Frontier told Nikkei xTECH it has identified the intrusion path. It will not disclose it "for security reasons". No CVE or product has been named.
- Attacker claims (unverified): customers took screenshots before they were locked out of the console. These show a message from the attacker claiming that the breach took "seven minutes", that 225 databases (3.6 PB) were encrypted, and that 554,153 snapshots were wiped (reported by BleepingComputer). No group has been named.
- Knock-on effects disclosed by customers:
- JR East and View Card (about 6.09 million accounts, mostly email addresses) and JR Kyushu (about 1.3 million accounts) said on 9 October that data in email-delivery services hit by the attack "may have been compromised". This came before IDC Frontier's finding that no data was taken from customer VMs. The two positions have not been reconciled publicly.
- Nissui Logistics stopped shipping at all sites and partly resumed on 9 October. It is building a new system on separate servers and expects normal operation at all sites in the week of 19 October. Nissui says no group personal or customer data was on the affected servers.
- E-commerce platform FutureShop, and the Ibaraki Prefecture and prefectural police websites, were also reported affected (Japan Cyber Watch).
- The wider wave (not linked to IDCF unless stated): in the same week, Japanese companies disclosed incidents including skyticket (up to 14.64 million records), Yakiniku King (10.79 million), Daiichikosho (8.72 million, possible), Bookoff (6.43 million), Lawson (about 2.15 million) and Mr Max (1.74 million). These figures come from company notices as reported by the Japan Times and Japan Cyber Watch. They are maximum or "possible" figures, they overlap, and they count records, not people. JPCERT/CC warned about attacks that abuse internal APIs found by analyzing smartphone apps, and about web shells planted on Java application servers. The National Cybersecurity Office, IPA, METI, MIC and the FSA issued their own warnings.
Affected Product Versions
This is a provider incident, not a product vulnerability, so no software versions are affected.
| Service | Status (IDC Frontier, 14 Oct) |
|---|---|
| IDCF Cloud, East Japan Region 1: tesla, henry, pascal, joule zones | Affected. Data in customer VMs not found to have been taken out; snapshot retrieval possible for 194 customers |
| IDCF Cloud, East Japan Region 1: radian, newton zones | Service not affected; safety checks ongoing |
| IDCF Cloud, East Japan Regions 2 and 3, West Japan Region 1 | Service not affected; safety checks ongoing |
| IDCF Cloud Portal | 48 customers' registration records improperly viewed; no exfiltration found |
| IDCF Cloud TypeS, IDCF Private Cloud | Not in scope |
Workaround and Mitigation
- Find your exposure, including through vendors (Rescana guidance). List vendors and subprocessors that host on IDCF Cloud, especially in East Japan Region 1. The visible impact so far has come through email-delivery, e-commerce and logistics services.
- Customers in the affected zones: follow IDC Frontier's individual contact about snapshot retrieval. Otherwise restore from independent backups.
- Customers in unaffected zones: IDC Frontier recommends taking your own backups as a precaution.
- Portal users (Rescana guidance; IDC Frontier's public notices do not advise a password change): if you were notified about the portal-record viewing, change your IDCF Cloud Portal password and review the notification contacts.
- Expect targeted phishing (Rescana guidance). Customers of JR East, JR Kyushu and the other services above should treat messages that use their real details with suspicion.
Indicators of Compromise
IDC Frontier has not published any. JPCERT/CC published attacker IP addresses for the wider API-abuse wave, but it has not linked them to IDCF. We do not reproduce them here. We will update this post if official indicators are released.
Sources
- IDC Frontier, 2nd report, 7 October (Japanese)
- IDC Frontier, 5th report, 14 October (Japanese)
- BleepingComputer: ransomware attack disrupts IDCF Cloud
- Nikkei xTECH (Japanese)
- Japan Cyber Watch, week of 10 October
- The Japan Times: Japanese firms' data breaches
What This Means for Your Third-Party Risk Program
This is a fourth-party event. Sending a questionnaire to every supplier is too slow, and assuming no exposure is wrong. A fast but accurate review identifies which vendors and subprocessors actually run on the affected platform, and what of yours sits there. Ask them:
- Do you, or any of your subprocessors, host on IDCF Cloud? If so, which region and zone?
- Which of our data or services, such as email delivery, e-commerce or logistics, ran on the affected zones?
- Did you have independent backups or snapshots, and what is your restore status?
- Have you received IDC Frontier's individual notices, including the portal-record notice, and will you share any finding that our data was accessed?
Forward this to your TPRM owner: IDC Frontier has confirmed that ransomware hit its IDCF Cloud on 7 October, affecting 495 organizations. JR East, JR Kyushu, Nissui and others have reported knock-on effects. Please check whether any of our vendors or their subprocessors host on IDCF Cloud, and send them the four questions above.
If you want to find which of your vendors and their subprocessors run on IDCF Cloud, and track their answers on restore status and data exposure, book a demo.
