Customers in part of the provider’s East Japan region have been told their data may be lost for good, and that their own backups may be the only way to recover.
A ransomware attack on IDC Frontier, one of Japan’s largest domestic cloud providers, has spread across the country’s digital and physical supply chains. It has disrupted services at railway operators, a prefectural police force, a frozen-food logistics firm and dozens of consumer platforms.
IDC Frontier is owned by SoftBank, the Japanese conglomerate and major OpenAI investor. Its IDCF Cloud platform is positioned as a homegrown alternative to Amazon Web Services, Microsoft Azure and Google Cloud, and it appeals to companies and public bodies that want their data hosted on Japanese soil. That concentration of customers turned a single breach into a nationwide problem. In a statement released Wednesday, the company said 495 companies and local government services had been affected.
Four C Zones severely Damaged
According to IDC Frontier, the intrusion happened in the early hours of Wednesday and knocked part of its server infrastructure offline. In a follow-up notice on Thursday, the provider said four cloud zones had been damaged so badly that affected customers would need to rebuild their systems on other infrastructure.
“It is expected that it will be difficult to retrieve or restore customer data stored in a part of East Japan Region 1,” the company said. It added that its current view is that recovery “will only be possible from backup data held by the customer themselves.”
The company has not disclosed how the attackers gained access or who is behind the attack. It has also not said whether a ransom was demanded, or whether data was stolen as well as encrypted.
Attackers claim 3.6 petabytes encrypted in Seven Minutes
Screenshots that purport to come from the attackers have circulated on social media under the message “Your Cloud is Ours.” The attackers claim they:
- Gained access to 239 systems running virtual machines
- Locked 225 large storage systems holding 3.6 petabytes of data
- Encrypted more than 16,600 virtual machine disks
- Deleted 554,153 backup snapshots
They say the whole operation took seven minutes.
None of these claims have been independently verified. Cybernews researchers found that the cloud console shown in the screenshots was inaccessible. The ransom note also does not name any known ransomware group.
Millions of Rail Customers potentially Exposed
East Japan Railway Company (JR East), the country’s largest rail operator, and its credit card subsidiary View Card were among the first organizations to confirm they were affected. The companies said up to 6.09 million records may have been accessed through email delivery services hosted on IDCF Cloud. Separately, JR Kyushu reported that around 1.3 million email records were affected. Both operators said credit card numbers, home addresses and phone numbers were not exposed.
Food Logistics Disrupted
The impact has reached beyond data. Nissui Logistics, a frozen-food warehousing firm and IDCF customer, reported a systems failure that stopped it from receiving and shipping goods. The company runs 17 cold storage and distribution centers with roughly 400,000 tonnes of capacity. These centers serve manufacturers, wholesalers, retailers and restaurants, so any extended outage could ripple through Japan’s food distribution network.
A Widening List of Victims
According to Japan Cyber Watch reports, other organizations believed to be affected include:
- Ibaraki Prefectural Police
- the news agency Jiji Press
- the fan messaging app for the all-female idol group SKE48
- the travel booking site Skyticket
- the karaoke operator Daiichikosho
- the e-commerce platform FutureShop
Only a small fraction of the 495 affected organizations has commented publicly so far. More breach disclosures are expected as customers assess their exposure.
Government Warning: “No longer just a problem for the IT department”
On Friday, Japan’s National Cybersecurity Office sent a letter to government ministries, to be passed on to local public bodies and private companies. The office was established last year after a string of high-profile incidents, including the ransomware attack on brewer Asahi.
“This is no longer just a problem for the IT department,” the letter warned. It urged organizations to:
- keep their security protections up to date
- use strong passwords
- tighten defenses across their supply chains
The letter also noted that artificial intelligence is making vulnerabilities “increasingly complex.”
The incident is likely to sharpen debate in Japan over the risks of relying on a small number of domestic cloud providers. In the push for data sovereignty, one compromised platform can now disrupt transport, policing and the food supply simultaneously.
Lessons for Every Business Running Online
The IDC Frontier attack shows how quickly a single breach can spread through a shared digital supply chain. In a matter of hours, one compromised cloud provider disrupted railway operators, a police force, a news agency, food logistics and dozens of consumer platforms. Many of the affected organizations did nothing wrong themselves. Their exposure came from relying on a third party. For some, the loss of data that cannot be recovered without their own backups may prove more costly than the outage itself.
Organizations of every size need to take ownership of their own security posture. That means keeping independent, offline backups, enforcing strong access controls, patching systems promptly, and continuously monitoring the applications and websites their customers rely on every day. This is where investing in professional cybersecurity services pays off. Continuous monitoring and early threat detection give businesses the best chance of spotting malicious activity before it turns into a full-scale incident, rather than learning about a breach after the damage is done.
For websites and web applications, solutions such as SiteLock provide around-the-clock protection.
