Ransomware · Cloud Security
Ransomware attack hits Japanese cloud provider IDCF, disrupts 495 clients
A ransomware attack on Japan's IDCF Cloud forced a shutdown and affected 495 organisations, including government clients. The company is still investigating the full impact.
Ross Grant3 min read
The short version
A major Japanese cloud provider, IDCF Cloud, was hit by a ransomware attack that disrupted services for 495 organisations, including government clients. The company shut down affected systems to stop the attack from spreading and is still investigating what happened. Some customers, such as a logistics company, have reported outages. It is not yet clear if any personal data was stolen.
By the numbers
- 495organisations affected by the IDCF Cloud outageBleepingComputer
- 3.6 PBdata attackers claim to have encryptedBleepingComputer
- 225databases attackers claim to have encryptedBleepingComputer
- 16,000virtual machine disks attackers claim to have sealedBleepingComputer
- 554,153snapshots attackers claim to have deletedBleepingComputer
- 119cybersecurity incidents involving data theft or exposure in Japan in 2026BleepingComputer
What happened?
IDC Frontier, a Japanese cloud provider, was hit by a ransomware attack on 7 October 2026. The attack caused an outage in its East Japan Region 1 data centre, affecting 495 companies and local governments. The company is still investigating the cause and full impact.
What happened to IDCF Cloud?
IDC Frontier, a major Japanese cloud and digital infrastructure company, reported a ransomware attack on its IDCF Cloud service. The incident began on 7 October at 3:40 AM local time. The attack caused an outage in a data centre cluster serving eastern Japan. The company responded by shutting down the affected systems to prevent the attack from spreading further. According to IDC Frontier, 495 companies and local governments use the impacted cloud service. The company is still investigating the cause and the full scope of the impact. BleepingComputer (opens in a new tab)
Who is affected?
The attack disrupted services for hundreds of organisations, including local governments. IDCF Cloud provides infrastructure-as-a-service (IaaS), renting out virtual servers, storage, and networking. Customers use these to run websites, applications, and business systems. The company proactively disabled customer access to management consoles for all regions as a precaution. Access will be restored only after security checks are complete.
A Japanese marine products company, Nissui Corporation, reported that its logistics subsidiary suffered a system outage due to suspected unauthorised access at a third-party data centre. This has stopped goods from being shipped or received. Nissui is investigating whether any personal or customer data was leaked. It is not yet clear if this outage is related to the IDCF Cloud incident.
What do we know about the attack?
Screenshots from customers before being locked out show a message from the attackers. The message claims they breached the East Japan Region 1 infrastructure in seven minutes. The attackers say they encrypted 225 databases (about 3.6 petabytes of data), accessed 239 hypervisors, sealed 16,000 virtual machine disks, and deleted over half a million snapshots. These claims have not been confirmed by IDC Frontier.
After detecting the attack, the company isolated and shut down impacted systems. They are now working to identify how the attackers got in and to check security in other regions. The company has not yet said whether any ransom was demanded or paid.
Wider context: a rise in attacks
This incident is part of a wider trend of increasing cyberattacks in Japan. According to Macnica, a security firm, there have been 119 cybersecurity incidents involving data theft or exposure in Japan so far this year. 83 of these happened between July and early October. For comparison, there were 84 such incidents in 2025 and 62 in 2024. Attackers are increasingly probing websites and APIs for weaknesses, often exploiting known vulnerabilities. Researchers suggest that cheap, capable AI tools may be making it easier for attackers to find and exploit security gaps.
What happens next?
IDC Frontier is still investigating the incident and has not yet restored full access to its cloud management consoles. Customers are advised to monitor for updates from the company and review their own security measures. It is not yet clear if personal or sensitive data has been compromised. Organisations using cloud services should ensure they have backups and incident response plans in place.
Practical advice for readers
If your organisation uses IDCF Cloud or similar services, check with your provider for updates. Review your own backup and recovery processes. Make sure you have a plan for responding to ransomware attacks, including how to communicate with customers if your systems are affected.
Claimed vs confirmed
- Unconfirmed
Attackers claim to have encrypted 225 databases, 3.6 PB of data, 239 hypervisors, 16,000 VM disks, and wiped 554,153 snapshots.
Screenshots from customers show these claims, but IDC Frontier has not confirmed them.
- Unconfirmed
Nissui Logistics' outage is linked to the IDCF Cloud attack.
It is unclear if the two incidents are connected.
The impact
- Money
- No financial loss or ransom amount has been disclosed. Under Japanese law, companies may face regulatory scrutiny and possible fines if personal data is found to be compromised.
- Reputation
- A ransomware attack on a major cloud provider can damage trust, especially among government and business clients. The incident has already caused service disruptions and public concern.
- Customers
- Customers face service outages and possible data loss. They should monitor updates from IDCF Cloud and review their own backup and incident response plans.
Why it matters
Hundreds of organisations, including local governments, rely on IDCF Cloud for their digital operations. A ransomware attack on a cloud provider can disrupt many businesses at once and put sensitive data at risk. This incident highlights the risks of relying on third-party cloud services and the growing threat of ransomware.
How does it work?
Ransomware is a type of malware that encrypts data on targeted systems, making it inaccessible until a ransom is paid. Attackers often gain access through vulnerabilities or weak credentials, then spread the malware to as many systems as possible before demanding payment.
Key points
- A ransomware attack disrupted IDCF Cloud, affecting 495 organisations.
- The company shut down systems to contain the attack and is still investigating.
- Attackers claim to have encrypted large amounts of data and deleted backups, but these claims are unconfirmed.
- Other companies, like Nissui Logistics, have reported outages possibly linked to the same incident.
- Ransomware attacks on cloud providers can have wide-reaching effects.
Sources
BleepingComputer
Reference
