A ransomware attack on one of Japan's enterprise cloud providers has knocked a slice of the country's digital infrastructure offline — and the company now says customer data in the affected zones may be gone for good.
IDC Frontier, the SoftBank-owned data center and cloud operator, disclosed on October 7, 2026 that unauthorized third-party access began at roughly 3:40 a.m. Japan time in part of its IDCF Cloud service. Investigators traced the disruption to a ransomware attack in East Japan Region 1, the cloud cluster running out of the company's data center in Shirakawa, Fukushima Prefecture. IDC Frontier moved quickly to isolate the region, disconnecting it from the network and halting systems to contain the intrusion and limit secondary damage.
The blast radius is what makes this incident stand out. IDC Frontier says 495 companies and local governments hold contracts tied to East Japan Region 1, and it is contacting each affected customer individually. This is not a breach at a single company — it is an outage at the infrastructure layer, where hundreds of organizations share the same underlying platform. Websites for Ibaraki Prefecture and the Ibaraki Prefectural Police went down, and budget carrier Peach Aviation reported its email delivery system — including the itinerary emails sent at booking — was disrupted, touching records for approximately 1.89 million passengers. Peach said no leak of personal information had been confirmed, and that payment and passport details were never stored on the affected servers.
The recovery outlook is sobering. In its third incident report, issued October 8, IDC Frontier told customers that data in the four affected zones is unlikely to be retrievable or restorable. Customers can restore only from backups they hold themselves, and the company is advising them to rebuild workloads in a separate environment. The management console remains suspended across all IDCF Cloud regions — not just East Japan Region 1 — and customers elsewhere are being asked to back up their own data as a precaution.
A few facts remain unconfirmed. IDC Frontier has not named the ransomware group responsible, has not said whether data was exfiltrated, and has not committed to a restoration timeline. The company has reported the attack to its supervisory ministry and the Tokyo Metropolitan Police Department, and says no unauthorized access has been found in its other zones and regions.
For enterprise IT teams, the lesson is familiar but freshly sharpened. Cloud consolidation moves resilience up the stack: when the provider's floor fails, every tenant's application fails with it, regardless of how well-architected the software is. The 3-2-1 backup rule gets a new corollary — one of those three copies had better live in an environment your provider cannot take down for you. Organizations running on shared cloud regions should know exactly which region their data sits in, hold tested off-platform backups, and have a rebuild playbook that assumes the provider's own tools, including the management console, may be unavailable.
This one is still developing. Expect IDC Frontier's incident reports, and the Tokyo police investigation, to fill in the how — and the industry to argue for a long time about the who.