IDC Frontier ransomware: SoftBank's cloud arm halts 495 customers, data may be unrecoverable

One cloud region stopped, and 495 companies and local governments across Japan stopped with it. Then the provider said it might not be able to give the data back. IDC Frontier, SoftBank's cloud and data center subsidiary, says East Japan Region 1 of its IDCF Cloud stopped responding at 3:40 a.m. Japan time on October 7, 2026, and confirmed a third-party ransomware attack. Virtual servers in four availability zones went down and would not restart. The next day the company told customers that recovering data from the affected infrastructure would be difficult and that they should "prepare a separate environment and rebuild your system." That implies the attack hit not individual servers but the virtualization layer beneath them.

1. Timeline

IDC Frontier says it is "continuing to investigate the precise cause and the scope of the impact." SoftBank's telecom services appear unaffected. Consoles will reopen region by region once cleared; no date has been given.

2. What the company confirmed vs. what the attacker claims

The attacker left an English-language message on the console. Named victims include Fibergate, whose Wi-Fi authentication failed, and Medialink, whose cloud telephony and IP-PBX went offline; public bodies and logistics, education and finance firms were also hit. A logistics subsidiary of seafood group Nissui halted shipments the same week after unauthorized access to a third-party data center; whether that is the same incident is unconfirmed.

3. Why the hypervisor was the target

Thousands of cloud virtual machines run on hypervisors. Lock that layer instead of each server and you can stop every VM and its snapshots at once — the point of the attacker's "seven minutes" boast.

Japanese security firm Macnica counts 119 personal-data theft or exposure incidents in Japan in 2026 through October 6 — already above all of 2025 (84) — with 83 since July. For the mechanics, see "What is hypervisor ransomware."

4. What remains unclear

• Data loss: how much customer data is permanently gone has not been disclosed.
• Entry point: how the attacker reached the management plane — stolen credentials or an unpatched flaw — is not public.
• Attacker and ransom: no group name or demand has been disclosed.
• Lesson: when public and private systems concentrate in one cloud region, one attack stops hundreds of organizations. The assumption that "it's in the cloud, so it's backed up" failed here; only backups kept outside that provider survive.