In the early hours of October 7, 2026, the domestic cloud service “IDCF Cloud” suffered a ransomware attack, resulting in a situation where data recovery is difficult in parts of the East Japan Region 1. Behind this are unauthorized access to the virtualization infrastructure and the destruction of management snapshots, causing serious and widespread impacts on 495 companies and local governments.

[Key Points of the Incident] Unauthorized access and the sequence of events leading to the disruption in the early hours of October 7th

Around 3:40 AM on October 7, 2026, unauthorized access by a third party occurred on “IDCF Cloud,” which is operated by IDC Frontier Inc., a wholly-owned subsidiary of SoftBank Corp. As a result of this attack, serious disruptions, such as the halting of virtual servers and the inability to restart them, occurred in some systems within the “East Japan Region 1” located at the data center in Shirakawa City, Fukushima Prefecture. To immediately prevent the spread of damage, the company implemented measures to isolate the network of East Japan Region 1 and suspend the management console. Furthermore, at 9:00 AM on October 7, an emergency response headquarters was established, and in cooperation with its parent company, SoftBank, they began technical investigations and customer support. It has become clear that this large-scale outage was not simply a facility malfunction, but a severe cyberattack utilizing ransomware, drawing significant attention as a major incident that undermines the security of Japan’s cloud infrastructure.

The diagram below shows the flow from the occurrence of the incident in IDCF Cloud to the initial response.

[Scale of the Incident and Scope of Damage] Ripple Effects on 495 Companies, Local Governments, and Social Infrastructure

The impact of this outage has affected 495 companies and local governments that have direct contracts with IDC Frontier. Systems operating in four specific zones—the tesla, henry, pascal, and joule zones—among the affected East Japan Region 1 suffered direct damage. In addition to websites of local governments and administrative agencies becoming inaccessible, the Warehouse Management System (WMS) at all 17 locations of Nissui Logistics, a subsidiary of logistics giant Nissui, shut down, resulting in delays in food shipments and deliveries for approximately 1,200 shipper companies. Furthermore, this escalated into a situation where a wide variety of services supporting social infrastructure halted simultaneously, including medical institution reservation systems, various SaaS-based business tools, and public relations sites for security agencies. Meanwhile, no unauthorized access has been confirmed in other zones of the East Japan Region 1 (the radian and newton zones), East Japan Regions 2 and 3, and West Japan Region 1, and safety verifications are currently underway.

Mechanisms of Data Recovery Difficulty and Blind Spots in Cloud Security

[Technical Mechanisms and Snapshot Destruction] Methods of Infrastructure Layer Intrusion

The most significant feature and threat of this attack was not that individual virtual servers (VMs) were targeted, but rather that the virtualization infrastructure managing and overseeing them (hypervisors and vCenter) was directly targeted. According to screen captures believed to be from the attackers that circulated on social media, it is claimed that in the East Japan Region 1, 239 hypervisors, 225 datastores, and over 16,600 VM disks were encrypted. Furthermore, it states that 554,153 snapshots—a cloud-based backup feature—representing approximately 41.5 PB of storage capacity, were deleted. While not all of these figures have been officially confirmed, if attackers gain control of the management plane (control infrastructure), the risk that not only production data but also snapshots and standard backups within the same management boundary could be simultaneously erased and destroyed has become a reality.

The following conceptual diagram illustrates the attack structure of an intrusion into the virtualization infrastructure and snapshot destruction.

【Reasons for Irrecoverability and Backup Challenges】The Limits of Recovery by Cloud Providers

In its third report, IDC Frontier officially announced that customer data stored in the four target zones (tesla, henry, pascal, and joule) is “expected to be difficult to retrieve or restore.” The company’s stance is that data restoration is “possible only from backup data held by the users themselves,” and it is advising affected customers to rebuild their systems after setting up a separate environment. No matter how much storage redundancy and periodic snapshotting are implemented in a cloud provider’s data center, if they are managed on the same authentication infrastructure or the same network as the production environment, there is a risk that all of them could be simultaneously destroyed if administrative privileges are compromised. The traditional myth that “data is automatically protected if it is placed in the cloud” has collapsed, highlighting the indispensable need to maintain physically and logically isolated offline backups (such as immutable storage) for data recovery.

Rebuilding Business Continuity and Future Outlook

[Impact on Society and Business Continuity (BCP)] Risk Management That Extends to Subcontractors’ Subcontractors

This incident has highlighted the danger of a “Single Point of Failure” (SPOF) in corporate Business Continuity Plans (BCPs). Even if a company does not have a direct contract with IDCF Cloud, if the SaaS vendors or business contractors they use depend on the cloud’s East Japan Region 1, they will suffer secondary or tertiary service suspension damages. Particularly in fields such as medical institutions, logistics, and finance, a system outage immediately leads to physical operational paralysis and economic loss. As pointed out in the newly established Maintenance Contractor section of the 7th edition of the “Guidelines for the Safety Management of Medical Information Systems” formulated by the Ministry of Health, Labour and Welfare in June 2026, it is extremely important for future risk management to ascertain the location of data and the separation status of backups not only at direct contractors but also at “sub-contractors of contractors (supply chain fourth-party risk)” through documentation and practical drills.

[Perspective of Legal Regulations and Personal Information Protection] Statutory Reporting Obligations and Contractual Exemption from Liability

If a cloud service provider suffers a cyberattack and data becomes unrecoverable, the legal response required from the user side also becomes complex. Based on Article 26 of the Act on the Protection of Personal Information and Article 7, Item 3 of its Enforcement Rules, personal data that has been encrypted and rendered unrecoverable due to unauthorized access falls under “corruption,” and even if the number of affected individuals is just one, it may trigger an obligation to submit a preliminary report (generally within 3 to 5 days) and a confirmed report (within 60 days) to the Personal Information Protection Commission. However, it is interpreted as not constituting corruption if the user maintains their own independent backups and is able to restore the data promptly. In addition, while cloud providers’ terms of service contain limitation of liability clauses (such as provisions capping damages at an amount equivalent to the usage fees), past court precedents show cases where the upper limit on damages was not applied when gross negligence was established. Corporate users must assess the legal risks associated with their data during normal times and prepare appropriate security management measures.

[Future Developments and Key Focus Areas] Strengthening Domestic Cloud Infrastructure and Effective Preparedness

Points to watch going forward include, first, whether the investigation by IDC Frontier and external cybersecurity experts will clarify the detailed intrusion vectors of the unauthorized access (such as VPN device vulnerabilities, credential leaks, and the abuse of privileged IDs). Second is the reality of RTOs (Recovery Time Objectives)—specifically, how long it will take the 495 affected companies and local governments to complete their own backup restorations or rebuild on a separate cloud. Triggered by this incident, the adoption of not only “preventative measures” but also “immutable storage” (which retains data even if administrative access is compromised) and practical recovery drills at least once a year is expected to spread rapidly across Japan’s IT industry as a whole. There is a strong demand for a shift in system design centered on resilience—focusing not on “where to run it,” but “how to recover when it stops.”

Reference page

• [[3rd Update] Regarding Service Disruptions Caused by Unauthorized Access to Some of Our Systems | IDC Frontier] https://www.idcf.jp/news/topics/20261008001
• [Guidelines for the Safe Management of Medical Information Systems (Version 7.0) | Ministry of Health, Labour and Welfare] https://www.mhlw.go.jp/stf/shingi/0000516275_00006.html

【#IDCFCloud #Ransomware #Cybersecurity #CloudOutage #DataRecovery #BusinessContinuityPlan #InformationSecurity】