Skip to content
TALAYINSIGHT
The glass-clad Tokyo Portcity Takeshiba office tower in Minato, Tokyo, with planted terraces on its lower floors
RegionAsia-Pacific

HighII Cyber Warfare & Critical Infrastructure7 October 2026, Wednesday

Ransomware hits SoftBank's cloud unit, affecting 495 customers

The IDCF Cloud service of SoftBank-owned IDC Frontier went down in a ransomware attack at 03:40 Japan time on 7 October. Some 495 companies and local governments were affected; on 8 October the company said customer data in four zones would be difficult to recover.

The Tokyo Portcity Takeshiba office tower, home to SoftBank Corp.'s headquarters. Photo taken 2 July 2022 (representative archive photo; not the Shirakawa data centre that was attacked)Photo: Beryllium Transistor / Wikimedia Commons · CC BY-SA 4.0 · resized · Source
Location: SHIRAKAWA

Impress Watch reports that the attack hit East Japan Region 1, which runs in a data centre in Shirakawa, Fukushima. In its second notice IDC Frontier confirmed ransomware as the cause and isolated and shut down the region. An NHK report cited by SBS says websites of the Ibaraki prefectural government and police went offline. At Nissui's logistics unit, goods stopped moving in and out of all 17 centres.

According to the third notice, released on the evening of 8 October, virtual servers in four zones, named tesla, henry, pascal and joule, cannot be restarted. Extracting or restoring customer data in these zones is difficult; recovery is possible only from customers' own backups. Movable Type is moving 31 servers to Sakura Cloud because its backups were kept on Google Cloud. Soliton Systems said it had also lost its own backup servers on the same infrastructure.

Kodaira city in Tokyo announced on 8 October that names, addresses and phone numbers in application forms may be at risk. MLex reports that at least one prefecture could not reach its own backups once the provider's systems went down. As of 9 October it had not been disclosed whether data was leaked or how the attacker got in; the company has reported the incident to the supervising ministry and the Tokyo police.

Talay assessment

Bottom line

The attack put data in four zones of a single provider at risk of permanent loss, and the cost fell on customers who kept backups on the same infrastructure. Movable Type, with backups on another cloud, is migrating within days; Soliton went down together with its backups. The most likely path is pressure on Japanese public bodies and companies to keep backups with a second provider.

Likely effects

  • Local government servicesNegativeWeeks

    Websites and application systems at bodies such as Ibaraki and Kodaira stay down for days, and whether citizens' data leaked may remain unclear for weeks.

  • Choice of cloud providerNegative1–6 months

    The risk of data loss in four zones pushes customers toward rivals such as Sakura Cloud and toward multi-cloud backups.

  • Logistics and supplyNegativeWeeks

    As at Nissui's 17 centres, logistics systems tied to a single provider turn a cyber incident directly into a shipping halt.

Possibilities, ranked

  1. 1
    Partial recovery, permanent migration55%

    Unaffected zones reopen, but a large share of customers in the four zones move to other providers using their backups.

    Watch: IDC Frontier's fourth notice and customer migration announcements

  2. 2
    Leak is confirmed30%

    An external investigation shows data was exfiltrated; municipalities and companies begin filing personal data breach notices.

    Watch: Leak statements from IDC Frontier and Kodaira city

  3. 3
    Data largely restored15%

    The company restores the four zones from its own backups faster than expected and the migration wave stays limited.

    Watch: Notice of the tesla, henry, pascal and joule zones reopening

Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.

Market reaction

Indicators affected

  • Companies and local governments affected▼ 495
  • Zones with hard-to-recover data▼ 4
  • Nissui logistics centres halted▼ 17

Sources

  1. Impress Watch — IDCF Cloud outage caused by ransomware attack, 495 companies and local governments affected
  2. SBS News — SoftBank Subsidiary Hit by Ransomware, Affecting 495 Companies and Local Governments
  3. セキュリティ対策Lab — IDCF Cloud: customer data in four zones 'difficult to extract or restore' (third notice)
  4. note (脱線ノート) — IDCF Cloud Outage: A Breakdown of Affected Companies and Services
  5. MLex — Japan cloud ransomware attack exposes municipal backup vulnerabilities