Key takeaways

  • IDC Frontier (IDCフロンティア), a data center and cloud company owned by SoftBank, says unauthorized access to part of its IDCF Cloud caused an outage from about 03:40 on October 7, 2026.
  • The outage is in East Japan Region 1, based at a data center in Shirakawa, Fukushima, according to Nikkei. Customers' services hosted there are down, including the websites of Ibaraki Prefecture and the Ibaraki Prefectural Police, according to SoftBank as reported by Kyodo News. IDC Frontier has no recovery date yet.
  • The company has not said whether this is ransomware, whether data was encrypted or taken, or how many customers are affected.
  • Images circulating on social media, presented as the attacker's, claim that the region's virtualization infrastructure was encrypted and its snapshots destroyed. They have not been verified.

What is IDCF Cloud?#

Outside Japan, IDCF Cloud is not well known. Inside Japan, it is one of the main domestic alternatives to AWS, Microsoft Azure and Google Cloud, aimed at companies and public bodies that want their systems run by a Japanese provider in Japanese data centers.
Operator IDC Frontier Inc., wholly owned by SoftBank Corp. It was part of the Yahoo Japan group from 2009 and rejoined the SoftBank group in 2018. In April 2026 it transferred its data center business to SoftBank and now focuses on cloud services
Service IDCF Cloud, launched in October 2014, building on public cloud services the company has offered since 2009. It describes the service as one of the largest Japanese-run clouds, with 15 zones across East and West Japan
What it offers Virtual machines, dedicated hardware, managed databases and load balancers, and a dedicated private cloud built on VMware technology. The smallest virtual machines start at a reference price of about ¥560 a month
Data centers Run by SoftBank, including Shirakawa (Fukushima), Kitakyushu (Fukuoka) and Fuchu (Tokyo)
Certifications ISO/IEC 27001 and ISO/IEC 27017. Parts of IDCF Cloud, including its compute service, are registered under ISMAP, the Japanese government's security assessment program for cloud services, which allows government agencies to procure them

Its customers include online services, media companies and, according to Nikkei, local governments and the public sector. The affected East Japan Region 1 is one part of this footprint.

What IDC Frontier has said#

IDC Frontier's notice, published on October 7, is short:
When About 03:40, Wednesday, October 7, 2026
Where East Japan Region 1 of IDCF Cloud
Cause Unauthorized access by a third party
Status Part of the service is down. The company is investigating, and checking the safety of areas not affected

Affected customers are being contacted individually. The company will publish further facts as they are confirmed. IDCF Cloud has three regions in East Japan and one in West Japan, according to ITmedia. Only one is named as affected.

Who is affected#

IDCF Cloud is used by businesses and, according to Nikkei, by local governments and the public sector. IDC Frontier has not named any customers.

These are the sites and services we have found affected so far, sorted by how firmly the link to IDCF Cloud has been confirmed:

Organization What stopped Link to IDCF Cloud
Ibaraki Prefecture Official website, from about 04:00. Application forms could not be downloaded Confirmed by SoftBank, according to Kyodo News
Ibaraki Prefectural Police Official website, from about 10:00. Information on driver's license renewal unavailable Confirmed by SoftBank, according to Kyodo News
Greenwich Online store tools Rakuraku Zaiko, Rakuraku Saiyasu Koshin and Ultra ASP: inventory syncing and price updates stopped Confirmed by the company, which names the IDCF Cloud outage in its notice
Ibaraki Prefectural Assembly, Kodaira City (Tokyo), Adachi Ward (Tokyo), Tobu Zoo Websites unavailable on October 7 Not confirmed. They did not name a provider, according to ITmedia
Shimizu S-Pulse, Kyoto Sanga F.C. (J.League football clubs) Websites unavailable on October 7 Not confirmed. They cited a problem at their "server management company" without naming it

Other service providers have posted similar notices on social media. Matsumoto City, whose website also went down that day, attributed its outage to an external translation service, so it may be unrelated.

The list shows how far one cloud region reaches: a prefectural government, its police, online retailers' back-office tools and, possibly, other municipalities and sports clubs, all down from the same early-morning incident.

The unverified claims#

Images shared on social media, presented as the attacker's, show messages such as "IDCF CLOUD INFRASTRUCTURE SEIZED" and "YOUR CLOUD IS OURS". According to Security Taisaku Lab, they claim that:

  • 239 hypervisors were reached
  • 225 of 225 datastores were encrypted
  • More than 16,600 virtual machine disks were affected
  • More than 550,000 snapshots were destroyed

These are claims, not confirmed facts. IDC Frontier has not commented on them. No ransomware group has been named, no ransom demand has been seen, and as of October 7 we found no listing on ransomware leak site trackers. We are not reproducing the images.

What we don't know yet#

IDC Frontier has not said:

  • How the attackers got in, and what they accessed
  • Whether this is a ransomware attack, and whether customer data was encrypted, deleted or taken
  • How many customers and virtual machines are affected
  • Whether customers' backups and snapshots in the region are intact
  • When service will be restored
  • Whether the other regions are confirmed safe

Our analysis#

When the cloud provider is the victim#

For IDCF Cloud's customers, this is an incident they cannot fix themselves. Their applications may be well run, but if the provider's infrastructure is down, so are they, and they depend on the provider for information about their own data. Greenwich, for example, says it is still checking the scope of the impact on its own services.

That is the same pattern we saw this week with Scala Communications, where one breach at a software vendor reached several client companies, and with Asahi Kasei Therapeutics, whose website was breached through its operator. Here the shared layer is the cloud itself.

Snapshots are not backups if they live in the same place#

We do not know what happened to customers' data in this case. But the claims circulating, of encrypted datastores and destroyed snapshots, describe a scenario every cloud customer should plan for. Snapshots and backups kept in the same provider and region as the systems they protect can be lost along with them. Attackers who reach the virtualization layer, as in the Osaka Metropolitan University attack this week, look for backups first. At least one copy of important data should be kept somewhere the provider's infrastructure cannot reach, such as another provider or an offline copy.

A fast but thin first notice#

IDC Frontier disclosed the incident on the same day, named the region and gave the cause as unauthorized access. That is quick. But in the absence of more detail, images claiming much more are spreading on social media, and customers and the public are left to weigh them without official information. The most useful next step would be a clear statement on whether customer data and backups were affected, even if the answer is still "under investigation" for some of them.

What this means for readers#

  • If you use IDCF Cloud, check IDC Frontier's notices and any individual contact. Assume systems in East Japan Region 1 may need to be restored from backups held elsewhere, and plan for that now.
  • If you use a service that stopped on October 7, check the provider's own notice before assuming the cause. Several unrelated outages were reported the same day.
  • If you run systems on any cloud, make sure at least one backup copy is outside your provider's reach, and test that you can restore from it.

Japanese terms at a glance#

Japanese Reading Meaning
IDCフロンティア Ai-dī-shī Furontia IDC Frontier Inc., SoftBank's data center and cloud subsidiary
東日本第1リージョン Higashi Nihon dai-ichi rījon East Japan Region 1
第三者からの不正アクセス daisansha kara no fusei akusesu Unauthorized access by a third party
障害 shōgai Outage, failure
仮想化基盤 kasōka kiban Virtualization platform
スナップショット sunappushotto Snapshot (point-in-time copy)

This is a developing story. We will update this article as IDC Frontier and its customers publish more.