At about 3:40 a.m. Japan Standard Time (JST) on October 7, 2026, a ransomware attack shut down virtual servers in part of IDC Frontier’s IDCF Cloud platform. In its October 8 notice, the SoftBank Group subsidiary counted 495 affected companies and local governments. It warned that data in several zones would be difficult to extract or restore and that customers would need to rely on backups they held.
An outage limited to part of one region
IDC Frontier located the incident in East Japan Region 1, specifically in parts of the tesla, henry, pascal, and joule zones. Affected virtual machines stopped and could not be restarted. The company isolated the relevant network and suspended management consoles to limit further spread and data leakage.
The 495 organizations named by IDC Frontier are companies and local governments using the service. Jiji Press reported that websites for Ibaraki Prefecture, the city of Kodaira, Tobu Zoo, and Jiji Press became inaccessible or could not be updated. Sources do not establish that every hosted service or every IDCF Cloud region was affected.
The provider says recovery depends on customers
IDC Frontier said it was investigating the precise cause and impact. For data stored in the affected zones, the provider expected extraction or restoration to be difficult and said customers would need to restore from their own backups. A separate environment was being prepared so systems could be rebuilt.
The notice also asked customers in other regions to maintain backups. At that time, IDC Frontier said it had not confirmed unauthorized access in those other zones, while suspending external management consoles during its checks. That precaution should not be confused with confirmation that the entire platform was compromised.
In its October 9 update, IDC Frontier said it had established an emergency response headquarters at 9 a.m. on October 7, working closely with SoftBank. The company said it was guiding customers on backup procedures and proposing a migration environment; it could also start or stop virtual machines at customer request. Its technical teams were continuing the investigation and preparing a recovery plan with outside security specialists. This describes work under way, not completed recovery, and does not reverse the October 8 notice that affected data would need to be restored from customer-held backups.
Keep attacker claims in context
BleepingComputer reported that a message attributed to the attacker claimed it had encrypted 225 databases and 3.6 petabytes of data, accessed 239 hypervisors, and deleted more than 554,000 snapshots. These figures came from the malicious actor and were not confirmed in IDC Frontier’s notice. They should not be presented as an established impact assessment.
The provider confirmed a ransomware attack, virtual-machine outages, and uncertain recovery for data in some zones. The reports reviewed did not confirm that data had been exfiltrated. Investigators still needed to establish the entry point, exact scope, and affected systems.
Plan recovery that does not depend on the provider
Organizations using cloud services should verify that backups remain accessible when a provider console is unavailable. Keep a separate copy of production environments, restrict which credentials can delete backups, and periodically test a full restore, including the dependencies needed to bring a service back online.
Affected IDCF Cloud customers should follow official instructions, confirm which data and zones are in scope, and restore from copies they control. Before reconnecting rebuilt systems, check their integrity, rotate secrets that may have been exposed, and preserve available logs for investigation. These are general recommendations; they do not presume the cause of the IDCF incident.
How Soclyde relates
Soclyde does not back up cloud servers or restore IDCF virtual machines. Its local-first vault concerns passwords and access: vault data stays encrypted on devices instead of in a centralized cloud vault operated by Soclyde. Backups for business systems and password vaults are separate procedures that their owners must prepare and test.
What to remember
The attack disrupted virtual servers in part of East Japan Region 1; IDC Frontier counted 495 affected customers and directed organizations to their own backups for recovery. The attacker’s claimed impact figures remain unconfirmed. Our password vault backup guide explains how to plan for access recovery separately from cloud-service restoration.
