Ransomware attack on IDC Frontier disrupts IDCF Cloud and Japanese government sites

On 7 October 2026, IDC Frontier — the SoftBank Group subsidiary that operates the IDCF Cloud infrastructure-as-a-service platform from Japanese data centers — suffered a ransomware attack that forced an emergency shutdown of part of its cloud service. The company said the failure began at around 3:40 AM local time, when an automatic protection system activated following the attack and blocked the service network to prevent secondary damage and data leaks.

The disruption hit the platform's East Japan Region 1, one of three cloud regions the company operates in eastern Japan, and caused an outage across a data-center cluster serving the region. IDC Frontier rents virtual servers, storage, and networking to roughly 495 companies and local governments, and the shutdown left many of their websites and systems unavailable.

Impact

Jiji Press reported that websites belonging to Ibaraki Prefecture, the Tokyo city of Kodaira, Tobu Zoo in Saitama Prefecture, and Jiji Press itself could not be viewed or updated during the outage. Because IDC Frontier does not publicly disclose its client list, that roster is illustrative rather than complete. According to unverified claims attributed to the attacker and circulated in screenshots shared by customers, the intruder said it had encrypted databases and sealed thousands of virtual-machine disks across the region — figures the company has not confirmed.

IDC Frontier has not confirmed whether any customer data was exfiltrated, and recovery timing remains unclear. A related system outage at Nissui Logistics, tied to suspected unauthorized access at a third-party data center, was reported around the same time, though it is not confirmed to be connected to the IDCF incident.

Response

The company isolated and shut down the affected systems in East Japan Region 1, disabled customer access to the management consoles for all of its regions as a precaution, and began working to identify and block the intrusion route. IDC Frontier said it is developing an alternative environment for affected customers while it investigates the precise cause and scope of the attack, and that access will be restored once systems are confirmed safe.