Ransomware Hits Japan’s IDCF Cloud, Knocks 495 Clients Offline

A ransomware attack on a Japanese cloud platform has knocked services offline for 495 organizations. IDCF Cloud, run by IDC Frontier, confirmed the attack on October 7, 2026. IDC Frontier is a cloud and data-center company owned by SoftBank. The attack shows how one break-in at a cloud provider can hurt hundreds of customers at once.

What happened

IDC Frontier said unauthorized access began at about 3:40 am Japan time on October 7. The company soon confirmed that a third party had launched a ransomware attack. Ransomware is malicious software that locks computer systems until a payment is made. The attack hit one cloud region and took down services for 495 contracting companies and local governments. Websites belonging to Ibaraki Prefecture and the Ibaraki prefectural police headquarters became inaccessible, according to NHK World.

No group has claimed the attack

So far, no ransomware group has publicly claimed responsibility. IDC Frontier described the incident only as a ransomware attack by a third party. The company said it is investigating whether any customer data was stolen. As of now, no data theft has been confirmed and no stolen data has been published. BleepingComputer and Japanese outlets including Internet Watch have covered the incident. Experts say the lack of a claim is unusual, as most ransomware groups quickly name their victims to pressure them into paying.

Why this attack matters

Security experts say the most worrying part is the concentration effect. A single intrusion into one cloud region disabled services for nearly 500 organizations at the same time. Many of these are small companies and local governments that depend fully on the cloud provider. They cannot simply switch to backup systems. The incident is a reminder for businesses to keep their own backups and have a plan for when a shared cloud service goes down. IDC Frontier is working to restore services, but has not given a full timeline for recovery.

Cloud attacks are on the rise

Attackers increasingly target cloud providers because one break-in can hit many victims. In recent days, other ransomware groups have also been active. The Akira group claimed an attack on the Louis Fusco Group, saying it stole 465GB of data. Another group listed Turn5, an auto parts company, claiming 328GB of stolen files. These attacks show that no sector is safe, from cloud hosts to car parts makers.

Security experts advise companies to keep their own backups, separate from their cloud provider. They should also have a written plan for what to do when systems go down. This includes how to contact customers and how to keep critical work running. For local governments like those in Ibaraki, website outages can block residents from key services. Regular security drills can reduce panic when a real attack happens.