Ransomware hits Japanese cloud provider IDCF, 495 organisations affected

A ransomware attack has hit IDCF Cloud, the cloud platform run by IDC Frontier, a SoftBank group company. The attack was detected on 7 October 2026 at 3:40 a.m. Japan time, in the East Japan Region 1 region. The company confirmed the attack and isolated the compromised systems. According to IDC Frontier, 495 organisations are affected.

Four availability zones in the eastern region were hit: tesla, henry, pascal and joule. Virtual servers hosted in these zones can no longer be restarted. No intrusions have been confirmed in the other two zones of the same region. IDC Frontier has closed access to management consoles across all regions, not only the affected one. Operations on virtual machines are now carried out manually by technicians, on customer request.

The provider considers data recovery very difficult and has said that only backups kept by customers themselves can be relied on. Customers have been advised to move their systems to other platforms. The company warned: "Customers without separate backup copies risk the irreversible loss of their information."

Consequences for JR East

On 9 October, railway operator JR East reported possible access to customers' personal data, through a contractor linked to the affected infrastructure. The risk concerns the Ekinet ticket booking service and the Weekend Adult Club loyalty programme. Exposed data could include dates of birth, membership numbers and credit card expiry dates. JR East found no access to names, addresses, phone numbers or full card numbers.

Subsidiary View Card reported a separate risk, concerning around 4.03 million email addresses. Combined, the two cases involve around 6.09 million potentially affected registrations, with possible duplicates between the databases. It has not been confirmed that the attackers actually copied the data.

The attackers claim, in a statement not confirmed by IDC Frontier, to have compromised 239 hypervisors and encrypted 225 repositories, totalling 3.6 petabytes of data. They also claim to have disabled more than 16,600 virtual disks and destroyed 554,153 snapshots, resulting in a loss of 41.5 petabytes of backup storage capacity.