A ransomware attack against Japanese cloud provider IDC Frontier has disrupted services used by 495 companies and local governments, leaving virtual servers inaccessible and raising concerns that some customers may be unable to recover their data without independent backups.
In an October 8 update, the SoftBank Group subsidiary warned that retrieving or restoring customer data stored in 4 affected cloud zones would be difficult. Based on its current assessment, the company believes recovery may only be possible using backups maintained by customers themselves.
The warning represents a significant escalation from the initial outage disclosed on October 7. Rather than a temporary service interruption, affected organizations now face the possibility of rebuilding their environments without access to data previously stored on the compromised infrastructure.
IDC Frontier has confirmed ransomware as the cause of the incident but has not identified the attackers or established whether customer information was stolen.
Four cloud zones face difficult recovery
The attack affected portions of IDCF Cloud’s East Japan Region 1, specifically the tesla, henry, pascal and joule availability zones.
According to IDC Frontier, virtual servers running in the affected environment stopped operating and could not be restarted.
The disruption began at approximately 3:40 a.m. Japan Standard Time on October 7 and remained ongoing when the company issued its third incident update on October 8.
IDC Frontier said its investigation indicated that recovering customer data from the affected infrastructure would be difficult. The company is therefore advising customers to prepare alternative environments and restore their systems using backups they already possess.
That distinction is particularly important for organizations that relied on the cloud provider’s infrastructure for both production workloads and recovery resources.
If usable backups are unavailable outside the affected environment, those customers could face prolonged outages or permanent loss of information. IDC Frontier has not confirmed how many organizations are in that position.
The company has also not disclosed the volume of data affected or provided a timetable for restoring the compromised zones.
495 companies and government organizations affected
IDC Frontier confirmed that 495 companies and local governments using IDCF Cloud were affected by the ransomware incident.
The provider has been contacting affected customers individually, although it has not published a complete list of organizations experiencing disruptions.
IDCF Cloud provides infrastructure services that allow businesses and public-sector organizations to operate virtual servers, applications, databases and other workloads in Japanese data centers.
An outage affecting this type of infrastructure can create consequences beyond the cloud provider itself. Organizations may lose access to websites, internal applications, customer-facing platforms and operational systems hosted in the affected environment.
The inclusion of local governments among the affected customers also raises concerns about the availability of public-sector digital services.
However, the number of affected organizations does not establish how many individual services are offline or whether every customer experienced the same level of disruption.
IDC Frontier has not provided a comprehensive breakdown of the operational impact across its customer base.
Provider isolates systems to contain ransomware
IDC Frontier initially disclosed unauthorized access to its cloud infrastructure on October 7. A subsequent investigation established that the disruption resulted from a third-party ransomware attack.
In its second incident advisory, the company confirmed that it had disconnected East Japan Region 1 from its network and shut down affected systems to prevent additional damage and potential information leakage.
Those containment measures were completed on October 7.
IDC Frontier is working with external cybersecurity specialists to identify the intrusion route, determine the full scope of the compromise and assess the security of its cloud infrastructure.
The investigation includes network, server and storage systems across the provider’s eastern and western Japan regions.
As an additional precaution, IDC Frontier disabled customer-facing management consoles in other regions while security checks continue.
The restriction means some customers cannot directly perform routine administrative operations through the usual management interface.
IDC Frontier said its personnel are temporarily performing certain virtual server operations, including starting and stopping instances, on behalf of customers who request assistance.
Other cloud regions remain under investigation
The company said it has not identified unauthorized access affecting several other IDCF Cloud environments, including East Japan Region 2, East Japan Region 3 and West Japan Region 1.
It also identified 2 additional zones within East Japan Region 1 where unauthorized access had not been confirmed.
Nevertheless, IDC Frontier is advising customers in those environments to create their own backups while the investigation continues.
The company said it would provide further guidance on backup procedures and restore management-console access after confirming that the relevant environments are secure.
IDC Frontier also clarified that IDCF Cloud Type S, formerly White Cloud ASPIRE, and its private cloud service are outside the scope of the incident.
Ransomware group and data theft remain unknown
Although IDC Frontier has confirmed the ransomware attack, several important questions remain unanswered.
The company has not publicly identified the ransomware group responsible, explained how the attackers initially entered its environment or disclosed whether the intrusion involved stolen credentials, exploited vulnerabilities or another access method.
It has also not confirmed whether attackers extracted customer information before disrupting the infrastructure.
Ransomware incidents frequently involve both encryption and data theft, but there is currently insufficient verified evidence to establish whether this attack involved data exfiltration.
No ransom demand, negotiation details or payment information have been confirmed by IDC Frontier.
The provider said it has reported the incident to relevant supervisory authorities and Tokyo police while continuing its investigation.
Cloud backup dependency becomes central concern
The most significant development in the October 8 disclosure is the possibility that IDC Frontier cannot restore certain customer workloads from its affected infrastructure.
Cloud customers often assume that geographically distributed infrastructure, snapshots and provider-managed recovery capabilities offer protection against major outages. However, those protections depend on how backups are configured, where they are stored and whether attackers can access the systems responsible for managing them.
When ransomware compromises shared infrastructure or administrative systems, recovery can become considerably more complicated than restoring an individual infected server.
Independent backups stored outside the compromised environment can provide an additional recovery path, particularly when production systems and associated storage are inaccessible.
IDC Frontier’s latest advisory underscores that distinction. The provider is directing affected customers toward rebuilding their environments and restoring information from backups they control rather than promising that the compromised cloud data can be recovered.
For the 495 affected organizations, the immediate priorities are restoring essential services, determining whether usable backups exist and establishing the integrity of any recovered systems.
IDC Frontier said it would continue publishing updates as investigators establish the full impact and develop recovery measures.
