INCIDENT REPORT · CP-2026-009

IDCF Cloud Ransomware Attack

L3 · ELEVATEDCONFIRMED

On Oct 7, 2026 a ransomware attack on IDCF Cloud, run by SoftBank subsidiary IDC Frontier, stopped and encrypted virtual servers in four zones of its East Japan Region 1, affecting 495 companies and local governments. IDC Frontier said customer data in those zones is difficult to retrieve, found no evidence of exfiltration from customer virtual servers, and has not named an attacker.

Incident ID: CP-2026-009
Incident date: 07 OCT 2026
Detection date: 07 OCT 2026
Affected countries: Japan
Plotted location: Tokyo, Japan (Affected provider headquarters city (IDC Frontier))
Threat classification: Level 3 — ELEVATED
Classification rationale: Ransomware on a national cloud provider disrupted 495 organizations including local governments, with unrecoverable data.
Attack type: Ransomware
Nature: Malicious activity
Attack vector: Exploitation of an open-source software vulnerability in the cloud's authentication system (per IDC Frontier's Oct 27 findings as reported)
Sectors: Technology, Government, Transportation
Critical infrastructure: Yes
Organizations affected: IDC Frontier, JR East
Operational consequences: 495 corporate and local-government customers lost hosted systems; data in the affected zones was largely unrecoverable except for customers with snapshot/backup copies (reported at roughly 200). Downstream outages included public-sector portals, and JR East and its View Card subsidiary warned that email delivery services hosted on the platform may have exposed up to 6.09 million records.
Estimated financial impact: No reliably documented figure
Attribution (as stated): No official attribution recorded

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

IDCF Cloud Ransomware Attack

L3 · ELEVATEDCONFIRMED

Incident ID

CP-2026-009

Incident date

07 OCT 2026

Detection date

07 OCT 2026

Affected countries

Japan

Plotted location

Tokyo, Japan (Affected provider headquarters city (IDC Frontier))

Threat classification

Level 3 — ELEVATED

Classification rationale

Ransomware on a national cloud provider disrupted 495 organizations including local governments, with unrecoverable data.

Attack type

Ransomware

Nature

Malicious activity

Attack vector

Exploitation of an open-source software vulnerability in the cloud's authentication system (per IDC Frontier's Oct 27 findings as reported)

Sectors

Technology, Government, Transportation

Critical infrastructure

Yes

Organizations affected

IDC Frontier, JR East

Operational consequences

495 corporate and local-government customers lost hosted systems; data in the affected zones was largely unrecoverable except for customers with snapshot/backup copies (reported at roughly 200). Downstream outages included public-sector portals, and JR East and its View Card subsidiary warned that email delivery services hosted on the platform may have exposed up to 6.09 million records.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

No official attribution recorded