A SoftBank cloud tells customers to rebuild

IDC Frontier, a Japanese cloud company owned by SoftBank Corp, the telecoms arm of SoftBank Group, has told customers of its IDCF Cloud service that data in part of its East Japan Region 1 will be difficult to retrieve or restore after a ransomware attack, and that they should rebuild from their own backups. The company released its third report on the incident on 8 October, ASCII.jp reported. The attack began at about 3:40 a.m. local time on 7 October and affects 495 subscribers, including businesses and local governments.

The damage is concentrated in four zones. Virtual servers across four availability zones of East Japan Region 1 stopped and could not be restarted, SDxCentral reported. The company wrote, in a translation quoted by SDxCentral: "Given the current damage situation and security considerations, we are advising you to prepare a separate environment and rebuild your system." In its third notice, IDC Frontier named the affected zones as tesla, henry, pascal and joule. It said no unauthorised access had been confirmed in the region's other two zones, radian and newton, or in East Japan Regions 2 and 3 and West Japan Region 1, though it asked those customers to back up their data too.

The company says it does not yet know how the attackers got in. It has isolated the affected region from the network and shut the customer management console, and it has suspended consoles in other regions too while it checks their safety, according to ASCII.jp and the company's notices. It is still investigating the intrusion path and whether data was taken, and has given no recovery timeline, ASCII.jp said. In the meantime, IDC Frontier is starting and stopping virtual servers by hand when customers ask, the company said. It has reported the incident to supervisory ministries and the Tokyo Metropolitan Police Department, and set up an emergency response headquarters at 9 a.m. on 7 October in close coordination with its parent, SoftBank Corp, the company said.

The attacker left a message. Screenshots from customers before they were locked out of the console show the threat actor claiming it took seven minutes to breach the East Japan Region 1 infrastructure, BleepingComputer reported. The group claimed it encrypted 225 databases holding 3.6PB of data, reached 239 hypervisors, sealed 16,000 virtual machine disks and wiped 554,153 snapshots. SDxCentral's version of the message put the figures at almost 240 hypervisors, more than 554,150 snapshots and 41.5PB of backup capacity removed. These are the attacker's claims, and the accounts we read carried no confirmation of them from IDC Frontier.

The effects spread to customers' own customers. SDxCentral named Fibergate, an internet and Wi-Fi provider, which disclosed an impact on its Wi-Fi authentication services, and Medialink, whose cloud telephony services went offline. Public-sector bodies and firms in logistics, education and financial services were also affected. Six Apart said it was migrating and restoring the affected servers of its Movable Type cloud service, moving customers to Sakura Cloud and pausing new sign-ups for its IDCF Cloud plan. Separately, the food group Nissui said its logistics subsidiary suffered an outage that stopped shipping and receiving after suspected unauthorised access to a third-party data centre it uses. BleepingComputer said it was unclear whether that was connected.

Virtualisation layers are a known target. Google security research said virtualisation infrastructure was hit in about 43 per cent of the ransomware intrusions it responded to in 2025, up from 29 per cent in 2024, SDxCentral reported. Ransomware groups used automated scripts to reach multiple ESXi hosts, shut down virtual machines, delete snapshots and backups and deploy ransomware, it added. Japan's National Police Agency counted 123 reported ransomware incidents in the first half of 2026, a half-year record, the same record we reported in September.

The Macnica researcher Yutaka Sejiyama told BleepingComputer that Japan has logged 119 incidents involving personal data theft or exposure this year, 83 of them between 1 July and 6 October, compared with 84 in all of 2025 and 62 in 2024. He suggested cheap AI tools might be making it easier to find weaknesses in small targets.

For IDC Frontier's customers the lesson is blunt: the provider cannot restore what the attackers destroyed, so only their own copies count. The attack hit a unit of the group whose founder, Masayoshi Son, was reported this week to be seeking up to $100bn from Gulf investors. It also fits a pattern of attacks on infrastructure that customers assumed was protected, like the FortiBleed campaign that has locked owners out of their own firewalls.